An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9b7a6474a1 advisory.

    - Fixes CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit     bypass
    - Fixes CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
    - Fixes CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in     UpdateCacheMiddleware
    - Fixes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
    - Fixes CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin
    - Fixes CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable
    - Fixes CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded     file upload
    - Fixes CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit     bypass
    - Fixes CVE-2026-25674: Potential incorrect permissions on newly created file system objects


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4d1404fc5d advisory.

    - Fixes CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit     bypass
    - Fixes CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
    - Fixes CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in     UpdateCacheMiddleware
    - Fixes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
    - Fixes CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin
    - Fixes CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable
    - Fixes CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded     file upload
    - Fixes CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit     bypass
    - Fixes CVE-2026-25674: Potential incorrect permissions on newly created file system objects


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-de6e24ae07 advisory.

    - Fixes CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit     bypass
    - Fixes CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
    - Fixes CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in     UpdateCacheMiddleware
    - Fixes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
    - Fixes CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin
    - Fixes CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable
    - Fixes CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded     file upload
    - Fixes CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit     bypass
    - Fixes CVE-2026-25674: Potential incorrect permissions on newly created file system objects


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b9548393aa advisory.

    - Fixes CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit     bypass
    - Fixes CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
    - Fixes CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in     UpdateCacheMiddleware
    - Fixes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
    - Fixes CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin
    - Fixes CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable
    - Fixes CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded     file upload
    - Fixes CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit     bypass
    - Fixes CVE-2026-25674: Potential incorrect permissions on newly created file system objects


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20704-1 advisory.

    Changes in python-Django:

    - CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests       via file upload limit bypass (bsc#1264153)
    - CVE-2026-35192: Session fixation via public cached pages and       SESSION_SAVE_EVERY_REQUEST (bsc#1264154)
    - CVE-2026-6907: Potential exposure of private data due to incorrect handling       of Vary: * in UpdateCacheMiddleware (bsc#1264152)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1740-1 advisory.

    This update for python-Django fixes the following issues

    - CVE-2026-3902: headers spoofing by exploiting an ambiguous mapping of two header variants in     `ASGIRequest` requests       (bsc#1261729).
    - CVE-2026-4277: permissions on inline model instances were not validated on submission of forged POST     data in       GenericInlineModelAdmin (bsc#1261731).
    - CVE-2026-4292: admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances     to be created       via forged POST data (bsc#1261732).
    - CVE-2026-5766: potential denial-of-service vulnerability in ASGI requests via file upload limit bypass     (bsc#1264153).
    - CVE-2026-6907: potential exposure of private data due to incorrect handling of `Vary: *` in     `UpdateCacheMiddleware`       (bsc#1264152).
    - CVE-2026-33033: denial of service via missing or understated Content-Length header in ASGI requests     (bsc#1261722).
    - CVE-2026-33034: ASGI requests with a missing or understated Content-Length header could bypass the       `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading HttpRequest.body (bsc#1261724).
    - CVE-2026-35192: session fixation via public cached pages and `SESSION_SAVE_EVERY_REQUEST` (bsc#1264154).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the Django Python package is 5.2.x prior to 5.2.14 or 6.0.x prior to 6.0.5. It is, therefore, affected by multiple vulnerabilities, including:

  - ASGI requests with a missing or understated Content-Length header can bypass the FILE_UPLOAD_MAX_MEMORY_SIZE     limit, potentially loading large files into memory and causing service degradation. (CVE-2026-5766)

  - django.middleware.cache.UpdateCacheMiddleware erroneously caches requests where the Vary header contained an     asterisk ('*'). This can lead to private data being stored and served. (CVE-2026-6907)

  - Response headers do not vary on cookies if a session is not modified, but SESSION_SAVE_EVERY_REQUEST is True.
    A remote attacker can steal a user's session after that user visits a cached public page. (CVE-2026-35192)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8232-1 advisory.

    It was discovered that Django did not vary cached response headers on cookies when sessions were not     modified while SESSION_SAVE_EVERY_REQUEST was enabled. A remote attacker could possibly use this issue to     steal a user's session. (CVE-2026-35192)

    Kyle Agronick and Jacob Walls discovered that Django incorrectly handled ASGI requests with missing or     understated Content-Length header values. A remote attacker could possibly use this issue to cause Django     to use excessive resources, leading to a denial of service. (CVE-2026-5766)

    Ahmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly cached requests where the Vary     header contained an asterisk. A remote attacker could possibly use this issue to obtain sensitive     information. (CVE-2026-6907)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies     if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a     user's session after that user visits a cached public page. Earlier, unsupported Django series (such as     5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina     for reporting this issue. (CVE-2026-35192)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
315986	Fedora 44 : python-django5 (2026-9b7a6474a1)	Nessus	Fedora Local Security Checks	medium
315981	Fedora 43 : python-django5 (2026-4d1404fc5d)	Nessus	Fedora Local Security Checks	medium
315959	Fedora 44 : python-django6 (2026-de6e24ae07)	Nessus	Fedora Local Security Checks	medium
314604	Fedora 42 : python-django5 (2026-b9548393aa)	Nessus	Fedora Local Security Checks	medium
313704	openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:20704-1)	Nessus	SuSE Local Security Checks	medium
313665	SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:1740-1)	Nessus	SuSE Local Security Checks	medium
313213	Python Library Django 5.2.x < 5.2.14 / 6.0.x < 6.0.5 Multiple Vulnerabilities	Nessus	Misc.	medium
312650	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Django vulnerabilities (USN-8232-1)	Nessus	Ubuntu Local Security Checks	medium
312270	Linux Distros Unpatched Vulnerability : CVE-2026-35192	Nessus	Misc.	low

Detections

Analytics

CVE-2026-35192

low

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

low