Skip to main content
Services
How We Work
Technology
Results
Resources
Company
Log in
Get Assessment
Vulnerability Intelligence
FEDORA-2026-de6e24ae07
FEDORA-2026-de6e24ae07
MEDIUM
python-django6-6.0.5-1.fc44
Published May 12, 2026
Modified 1 weeks ago
Fix available
Details
Fixes CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass
Fixes CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
Fixes CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware
Fixes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
Fixes CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin
Fixes CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable
Fixes CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload
Fixes CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass
Fixes CVE-2026-25674: Potential incorrect permissions on newly created file system objects
Affected Packages
python-django6
Fedora 44
Fixed in:
6.0.5-1.fc44
python3-django
Fedora 44
Fixed in:
6.0.5-1.fc44
python3-django-bash-completion
Fedora 44
Fixed in:
6.0.5-1.fc44
python3-django-doc
Fedora 44
Fixed in:
6.0.5-1.fc44
References
REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2444118
Related
CVE-2026-25674
CVE-2026-33033
CVE-2026-33034
CVE-2026-35192
CVE-2026-3902
CVE-2026-4277
CVE-2026-4292
CVE-2026-5766
CVE-2026-6907
Ecosystems
Fedora 44
Timeline
Published
May 12, 2026
Modified
May 13, 2026
FEDORA-2026-de6e24ae07 | Mondoo Vulnerability Intelligence