Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Django Vulnerabilities - Potential Session Theft and DOS
published 6 months ago
Summary
Django, a popular Python web framework, has been found to have several security issues. If not addressed, these issues could allow attackers to steal user sessions or cause a denial of service, impacting the security and availability of your website. We recommend updating to the latest version of Django to fix these issues.
What to do
- Update canonical python-django to version 2:3.2.12-2ubuntu1.27.
- Update canonical python-django to version 3:4.2.11-1ubuntu1.16.
- Update canonical python-django to version 3:5.2.4-1ubuntu2.5.
- Update canonical python-django to version 3:5.2.9-0ubuntu4.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:22.04:LTS | canonical | python-django |
< 2:3.2.12-2ubuntu1.27 Fix: upgrade to 2:3.2.12-2ubuntu1.27
|
| Ubuntu:24.04:LTS | canonical | python-django |
< 3:4.2.11-1ubuntu1.16 Fix: upgrade to 3:4.2.11-1ubuntu1.16
|
| Ubuntu:25.10 | canonical | python-django |
< 3:5.2.4-1ubuntu2.5 Fix: upgrade to 3:5.2.4-1ubuntu2.5
|
| Ubuntu:26.04 | canonical | python-django |
< 3:5.2.9-0ubuntu4.1 Fix: upgrade to 3:5.2.9-0ubuntu4.1
|
Original advisory text
python-django vulnerabilities
It was discovered that Django did not vary cached response headers on
cookies when sessions were not modified while SESSION_SAVE_EVERY_REQUEST
was enabled. A remote attacker could possibly use this issue to steal a
user's session. (CVE-2026-35192)
Kyle Agronick and Jacob Walls discovered that Django incorrectly handled
ASGI requests with missing or understated Content-Length header values.
A remote attacker could possibly use this issue to cause Django to use
excessive resources, leading to a denial of service. (CVE-2026-5766)
Ahmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly
cached requests where the Vary header contained an asterisk. A remote
attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-6907)
cookies when sessions were not modified while SESSION_SAVE_EVERY_REQUEST
was enabled. A remote attacker could possibly use this issue to steal a
user's session. (CVE-2026-35192)
Kyle Agronick and Jacob Walls discovered that Django incorrectly handled
ASGI requests with missing or understated Content-Length header values.
A remote attacker could possibly use this issue to cause Django to use
excessive resources, leading to a denial of service. (CVE-2026-5766)
Ahmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly
cached requests where the Vary header contained an asterisk. A remote
attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-6907)
References
- https://ubuntu.com/security/notices/USN-8232-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-5766 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-6907 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-35192 Third Party Advisory
Timeline
Published5 May 2026
Updated7 May 2026
First seen7 May 2026
Sources
USN-8232-1 · OSV
Track software like this
Free during beta