Python Library Django 5.2.x < 5.2.15 / 6.0.x < 6.0.6 Multiple Vulnerabilities

low Nessus Plugin ID 318785

Synopsis

A Python library installed on the remote host is affected by multiple vulnerabilities.

Description

The detected version of the Django Python package is 5.2.x prior to 5.2.15 or 6.0.x prior to 6.0.6. It is, therefore, affected by multiple vulnerabilities, including:

- django.middleware.cache.UpdateCacheMiddleware does not add Authorization to the Vary response header for requests bearing that header without Cache-Control: public, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. (CVE-2026-35193)

- django.utils.cache.has_vary_header() does not strip leading or trailing whitespace from Vary response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. (CVE-2026-48587)

- django.core.mail.backends.smtp.EmailBackend fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake when fail_silently=True, which allows on-path network attackers to read email content via cleartext interception. (CVE-2026-7666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Django version 5.2.15, 6.0.6 or later.

Plugin Details

Severity: Low

ID: 318785

File Name: python_django_6_0_6.nasl

Version: 1.1

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 6/5/2026

Updated: 6/5/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Low

Base Score: 2.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-7666

CVSS v3

Risk Factor: Low

Base Score: 3.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Vulnerability Information

CPE: cpe:/a:djangoproject:django

Patch Publication Date: 6/3/2026

Vulnerability Publication Date: 6/3/2026

Reference Information

CVE: CVE-2026-35193, CVE-2026-48587, CVE-2026-6873, CVE-2026-7666, CVE-2026-8404

IAVA: 2026-A-0543

Detections

Analytics