oss-security - Django CVE-2026-5766, CVE-2026-35192, and CVE-2026-6907

Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAN+fQHwa5+=mRzFzmswkZwmKeEuGM4cSFnA0dd6VFcfb+YusAg@mail.gmail.com>
Date: Tue, 5 May 2026 17:05:02 +0200
From: Sarah Boyce <sarahboyce@...ngoproject.com>
To: oss-security@...ts.openwall.com
Cc: Django Security Team <security@...ngoproject.com>
Subject: Django CVE-2026-5766, CVE-2026-35192, and CVE-2026-6907

* Announce:
https://www.djangoproject.com/weblog/2026/may/05/security-releases/

* CVE JSON Record for CVE-2026-5766:
https://www.cve.org/CVERecord?id=CVE-2026-5766

* CVE JSON Record for CVE-2026-35192:
https://www.cve.org/CVERecord?id=CVE-2026-35192

* CVE JSON Record for CVE-2026-6907:
https://www.cve.org/CVERecord?id=CVE-2026-6907

In accordance with [our security release policy](
https://docs.djangoproject.com/en/dev/internals/security/),
the Django team is issuing releases for
[Django 6.0.5](https://docs.djangoproject.com/en/dev/releases/6.0.5/) and
[Django 5.2.14](https://docs.djangoproject.com/en/dev/releases/5.2.14/).
These releases address the security issues detailed below. We encourage all
users of Django to upgrade as soon as possible.

## CVE-2026-5766: Potential denial-of-service vulnerability in ASGI
requests via file upload limit bypass

ASGI requests with a missing or understated `Content-Length` header could
bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large
files into memory and causing service degradation.

As a reminder, Django [expects a limit to be configured](
https://docs.djangoproject.com/en/6.0/topics/security/#user-uploaded-content)
at the web server level rather than solely relying on
`FILE_UPLOAD_MAX_MEMORY_SIZE`.

This issue has severity "low" according to the Django security policy.

This issue was originally highlighted by Kyle Agronick in Trac. Thanks to
Jacob Walls for following up and reporting it.

## CVE-2026-35192: Session fixation via public cached pages and
`SESSION_SAVE_EVERY_REQUEST`

Response headers did not vary on cookies if a session was not modified, but
`SESSION_SAVE_EVERY_REQUEST` was `True`. A remote attacker could steal a
user's session after that user visits a cached public page.

This issue has severity "low" according to the Django security policy.

## CVE-2026-6907: Potential exposure of private data due to incorrect
handling of `Vary: *` in `UpdateCacheMiddleware`

Previously, `django.middleware.cache.UpdateCacheMiddleware` would
erroneously cache requests where the `Vary` header contained an asterisk
(`'*'`). This could lead to private data being stored and served.

This issue has severity "low" according to the Django security policy.

Thanks to Ahmad Sadeddin for the report.

## Affected supported versions

* Django main
* Django 6.0
* Django 5.2

## Resolution

Patches to resolve the issue have been applied to Django's
main, 6.0, and 5.2 branches.
The patches may be obtained from the following changesets.

### CVE-2026-5766: Potential denial-of-service vulnerability in ASGI
requests via file upload limit bypass

* On the [main branch](
https://github.com/django/django/commit/5a89e341bfc77dd67b7fd57b7091b6430558e1f4
)
* On the [6.0 branch](
https://github.com/django/django/commit/ad8f9e19e0897ea45ded7c046ff28daf6f773e92
)
* On the [5.2 branch](
https://github.com/django/django/commit/2ec27eda3ba6c14f0856e6e3eb1df07c41fd95e6
)

### CVE-2026-35192: Session fixation via public cached pages and
`SESSION_SAVE_EVERY_REQUEST`

* On the [main branch](
https://github.com/django/django/commit/7f6e9b55130d5158804c0acbc0b24ccb7422ed82
)
* On the [6.0 branch](
https://github.com/django/django/commit/1b0184aa657bc3f5859aeb0206e7c1e94e48b103
)
* On the [5.2 branch](
https://github.com/django/django/commit/47cf968c125e3fab317e10fe150ec479e745f995
)

### CVE-2026-6907: Potential exposure of private data due to incorrect
handling of `Vary: *` in `UpdateCacheMiddleware`

* On the [main branch](
https://github.com/django/django/commit/c79bdfc1351ef2a2ad95df36241a74c736ef20a1
)
* On the [6.0 branch](
https://github.com/django/django/commit/44ad76efcbe3c4ca0f08bb9dabe916f6374596c9
)
* On the [5.2 branch](
https://github.com/django/django/commit/2115d4eaee15107f5cd290d7cfcc5ffe3ad43661
)

## The following releases have been issued

* Django 6.0.5 ([tarball](
https://www.djangoproject.com/download/6.0.5/tarball/) | [checksums](
https://www.djangoproject.com/download/6.0.5/checksum/))
* Django 5.2.14 ([tarball](
https://www.djangoproject.com/download/5.2.14/tarball/) | [checksums](
https://www.djangoproject.com/download/5.2.14/checksum/))

The PGP key ID used for this release is Sarah Boyce: [3955B19851EA96EF](
https://github.com/sarahboyce.gpg)

## General notes regarding security reporting

As always, we ask that potential security issues be reported via private
email
to `security@...ngoproject.com`, and not via Django's Trac instance, nor via
the Django Forum. Please see
[our security policies](https://www.djangoproject.com/security/) for further
information.
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.