https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:07:27 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07722 bdu:2026-07722 https://cve.radiocsirt.org/vuln/bdu:2026-07722 https://cve.radiocsirt.org/vuln/bit-django-2026-3902 <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.</p> <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.</p> https://cve.radiocsirt.org/vuln/bit-django-2026-3902 https://cve.radiocsirt.org/vuln/euvd-2026-281098 EUVD-2026-281098 https://cve.radiocsirt.org/vuln/euvd-2026-281098 https://cve.radiocsirt.org/vuln/fkie_cve-2026-3902 <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-3902 https://cve.radiocsirt.org/vuln/ghsa-mvfq-ggxm-9mc5 <p><strong>Affected:</strong> PyPI: Django</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores.</p> <p>Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: Django</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores.</p> <p>Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-mvfq-ggxm-9mc5 https://cve.radiocsirt.org/vuln/oesa-2026-2217 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-33033)</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.(CVE-2026-33034)</p> <p>This issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie&amp;amp;#39;s response header does not change, but &amp;amp;quot;SESSION_SAVE_EVERY_REQUEST&amp;amp;quot; is &amp;amp;quot;true&amp;amp;quot;. A remote attacker could steal a user&amp;amp;#39;s session after the user visits a cached public page. Earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) have not b…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-33033)</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.(CVE-2026-33034)</p> <p>This issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie&amp;amp;#39;s response header does not change, but &amp;amp;quot;SESSION_SAVE_EVERY_REQUEST&amp;amp;quot; is &amp;amp;quot;true&amp;amp;quot;. A remote attacker could steal a user&amp;amp;#39;s session after the user visits a cached public page. Earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) have not b…</p> https://cve.radiocsirt.org/vuln/oesa-2026-2217 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10516-1 <p>python311-Django4-4.2.30-1.1 on GA media</p> <p>python311-Django4-4.2.30-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10516-1 https://cve.radiocsirt.org/vuln/pysec-2026-51 <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.</p> https://cve.radiocsirt.org/vuln/pysec-2026-51 https://cve.radiocsirt.org/vuln/suse-su-2026:1740-1 <p>Security update for python-Django</p> <p>Security update for python-Django</p> https://cve.radiocsirt.org/vuln/suse-su-2026:1740-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-3902 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-3902 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1002 <p>Ein Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1002