Skip to content
OpenAdvisories
Low WID-SEC-2026-1807 5 CVEs

Django: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Jun 4, 2026 · Updated Sep 30, 2026 · Revision 6 · de-DE

Vendor: Debian Vendor: Fedora Vendor: SUSE Vendor: Ubuntu Product: Linux Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Django ausnutzen, um Informationen offenzulegen.

Product

Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt.

Vulnerabilities 5

  • Low 3.1
    CVE-2026-35193

    Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware

    An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, wh…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Low 3.1
    CVE-2026-48587

    Potential exposure of private data via whitespace padding in Vary header

    An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to rea…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Low 3.1
    CVE-2026-6873

    Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie

    An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a coo…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Low 3.1
    CVE-2026-7666

    Potential unencrypted email transmission via STARTTLS in the SMTP backend

    An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Low 3.1
    CVE-2026-8404

    Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware

    An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that wer…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

Revision history

  1. #6

    Neue Updates von Ubuntu und Debian aufgenommen

  2. #5

    Neue Updates von openSUSE aufgenommen

  3. #4

    Neue Updates von openSUSE aufgenommen

  4. #3

    Neue Updates von SUSE aufgenommen

  5. #2

    Neue Updates von Fedora aufgenommen

  6. #1

    Initiale Fassung

References