Skip to content
OpenAdvisories
Medium WID-SEC-2026-1373 3 CVEs

Django: Mehrere Schwachstellen

Published May 5, 2026 · Updated Sep 30, 2026 · Revision 6 · de-DE

Vendor: Fedora Vendor: SUSE Vendor: Ubuntu Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt.

Vulnerabilities 3

  • Medium 5.3
    CVE-2026-5766

    Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass

    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradat…

    djangoproject Django python-django django Debian Ubuntu Alpine Wolfi PyPI
  • Medium 4.3
    CVE-2026-6907

    Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware

    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlie…

    djangoproject Django python-django django Debian Ubuntu Alpine Wolfi PyPI
  • Low 2.3
    CVE-2026-35192

    Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST

    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached p…

    djangoproject Django python-django django Debian Ubuntu Alpine Wolfi PyPI

Revision history

  1. #6

    Neue Updates von Ubuntu aufgenommen

  2. #5

    Neue Updates von Fedora aufgenommen

  3. #4

    Neue Updates von Fedora aufgenommen

  4. #3

    Neue Updates von openSUSE aufgenommen

  5. #2

    Neue Updates von SUSE aufgenommen

  6. #1

    Initiale Fassung

References