Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python-Django Security Update Fixes Critical Issues
published 6 months ago
Summary
This security update fixes three critical issues in Python-Django, including a potential denial-of-service attack, session fixation, and exposure of private data. If left unpatched, these vulnerabilities could compromise the security of your website or application. We recommend applying the update as soon as possible to ensure the continued security and integrity of your system.
Original advisory text
Security update for python-Django
This update for python-Django fixes the following issues:
Changes in python-Django:
- CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests
via file upload limit bypass (bsc#1264153)
- CVE-2026-35192: Session fixation via public cached pages and
SESSION_SAVE_EVERY_REQUEST (bsc#1264154)
- CVE-2026-6907: Potential exposure of private data due to incorrect handling
of Vary: * in UpdateCacheMiddleware (bsc#1264152)
Changes in python-Django:
- CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests
via file upload limit bypass (bsc#1264153)
- CVE-2026-35192: Session fixation via public cached pages and
SESSION_SAVE_EVERY_REQUEST (bsc#1264154)
- CVE-2026-6907: Potential exposure of private data due to incorrect handling
of Vary: * in UpdateCacheMiddleware (bsc#1264152)
References
- https://bugzilla.suse.com/1264152 Third Party Advisory
- https://bugzilla.suse.com/1264153 Third Party Advisory
- https://bugzilla.suse.com/1264154 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-35192 URL
- https://www.suse.com/security/cve/CVE-2026-5766 URL
- https://www.suse.com/security/cve/CVE-2026-6907 URL
Timeline
Published6 May 2026
Updated9 May 2026
First seen9 May 2026
Sources
openSUSE-SU-2026:20704-1 · OSV
Track software like this
Free during beta