PT-2026-30867 · Django+3 · Django+3

Jacob Walls + 1 · Published 2026-04-07 · Updated 2026-05-13 · CVE-2026-3902

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3, 5.2 through 5.2.12, and 4.2 through 4.2.29

Description The ASGIRequest component allows a remote attacker to spoof headers due to an ambiguous mapping of header variants (with hyphens or with underscores) to a single version with underscores.

Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2026-07722

BIT-DJANGO-2026-3902

CVE-2026-3902

ECHO-F4CA-F938-4210

GHSA-MVFQ-GGXM-9MC5

MGASA-2026-0093

OESA-2026-2217

OESA-2026-2218

OESA-2026-2219

OESA-2026-2220

OPENSUSE-SU-2026:10516-1

OPENSUSE-SU-2026:10517-1

OPENSUSE-SU-2026:10567-1

OPENSUSE-SU-2026:20578-1

PYSEC-2026-51

USN-8154-1

Affected Products

Django

Linuxmint

Red Os

Ubuntu

References · 60

• https://nvd.nist.gov/vuln/detail/CVE-2026-5766 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33034 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20578-1 · Vendor Advisory
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://djangoproject.com/weblog/2026/apr/07/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mvfq-ggxm-9mc5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33034 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2219 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8154-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-51 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4292 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2218 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0093.html · Security Note
• https://ubuntu.com/security/CVE-2026-3902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4277 · Security Note