Detections
Analytics
Alpine: multiple py3-django packages: security update to 5.2.16-r0
medium Tenable Cloud Security Plugin ID 444527
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the
`cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated
cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported
Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would
like to thank Chris Whyland for reporting this issue. (CVE-2026-48588)
- An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object,
which can disclose adjacent memory or cause service degradation via a potential segmentation fault when
the `vsi_buffer` property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and
3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting
this issue. (CVE-2026-53877)
- An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not
prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an
application uses values with newlines in an HTTP response, header injection can occur. Django itself is
unaffected because `HttpResponse` prohibits newlines in HTTP headers. Earlier, unsupported Django series
(such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank
Bence Nagy for reporting this issue. (CVE-2026-53878)
Solution
Update the py3-django library and its related packages to version 5.2.16-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2026-48588
Plugin Details
Severity: Medium
ID: 444527
Version: Revision 1.1
Type: Local
Published: 7/9/2026
Updated: 7/9/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 4.1
Percentile: 53.62
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-53878
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6.3
Threat Score: 1.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-53877
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 7/7/2026