Django Security Bulletin: Cookie Salt Collision, SMTP STARTTLS Failopen, and Cache Data Leakage via Vary/Header Issues (CVE-2026-6873/7666/8404/35193/48587)

Vulnerability Overview Django has released multiple security updates addressing the following vulnerabilities: 1. CVE-2026-6873: Signature Cookie Salt Namespace Collision - Description: The method may accept cookies from different contexts if the concatenation of the cookie name (key) and salt parameter results in the same string. - Impact: Low severity. 2. CVE-2026-7666: Unencrypted Email Transmission via SMTP Backend Due to STARTTLS - Description: When is enabled, a failed STARTTLS handshake may lead to the reuse of partially initialized connections, resulting in emails being sent without encryption. - Impact: Low severity. 3. CVE-2026-8404: Potential Exposure of Private Data via Case-Sensitive Cache-Control Directives in UpdateCacheMiddleware - Description: and the decorator incorrectly cache responses marked with private Cache-Control directives when mixed or uppercase values (e.g., ) are used. - Impact: Low severity. 4. CVE-2026-35193: Potential Exposure of Private Data in UpdateCacheMiddleware Due to Missing Vary: Authorization - Description: and the decorator allow caching of responses with an header (provided there is no header). To maintain consistency with the existing cache key generation mechanism, these responses are now cached based on the header. - Impact: Low severity. 5. CVE-2026-48587: Potential Exposure of Private Data Due to Space Padding in the Vary Header - Description: incorrectly caches responses containing header values with leading or trailing spaces. Since fails to recognize trailing spaces that include a wildcard, responses are stored and served when they should not be. - Impact: Low severity. Scope Affected Versions: - Django main - Django 6.1 (currently in alpha state) - Django 6.0 - Django 5.2 Remediation Patches Applied: - Patches for all the aforementioned vulnerabilities have been applied to the main, 6.1 (currently in alpha state), 6.0, and 5.2 branches of Django. - Patches can be obtained from the following changelogs: - Django 6.0.6 (tarball - Django 5.2.15 (tarball Specific Fixes: - CVE-2026-6873: Fixed the signature salt concatenation logic in . - CVE-2026-7666: Fixed the connection reuse issue after a failed STARTTLS handshake in the SMTP backend. - CVE-2026-8404: Fixed the handling of case-sensitive Cache-Control directives in and the decorator. - CVE-2026-35193: Fixed the caching handling of the header in and the decorator. - CVE-2026-48587: Fixed the handling of spaces in the header in . Code Snippet No specific POC code or exploitation code is included in this page. Summary Django has released multiple security updates addressing vulnerabilities related to signed cookies, SMTP mail transmission, and the caching middleware. Patches have been applied to all affected versions (Django main, 6.1, 6.0, 5.2). Users are advised to upgrade as soon as possible to ensure security.

Goal Reached Thanks to every supporter — we hit 100%!

Django Security Bulletin: Cookie Salt Collision, SMTP STARTTLS Failopen, and Cache Data Leakage via Vary/Header Issues (CVE-2026-6873/7666/8404/35193/48587)