PT-2026-37060 · Django Software Foundation+2 · Django+2

Cantina + 2 · Published 2026-05-05 · Updated 2026-05-09 · CVE-2026-35192

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.4 Django versions 5.2 through 5.2.13

Description When SESSION SAVE EVERY REQUEST is set to True, response headers do not vary based on cookies if a session remains unmodified. This allows a remote attacker to steal a user's session after the victim visits a cached public page. This is a session fixation issue where a session identifier can be compromised via public cached content.

Recommendations Update Django versions 6.0 through 6.0.4 to version 6.0.5. Update Django versions 5.2 through 5.2.13 to version 5.2.14.

Fix

Weakness Enumeration

CWE-539

Related Identifiers

BIT-DJANGO-2026-35192

CVE-2026-35192

GHSA-7H2M-M8VJ-598H

OESA-2026-2217

OESA-2026-2218

OESA-2026-2219

OESA-2026-2220

OPENSUSE-SU-2026:10708-1

OPENSUSE-SU-2026:10709-1

OPENSUSE-SU-2026:10718-1

PYSEC-2026-50

USN-8232-1

Affected Products

Django

Linuxmint

Ubuntu

References · 42

• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://djangoproject.com/weblog/2026/may/05/security-releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3902 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10708-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8232-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2217 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35192 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8232-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-50 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2218 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35192 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-35192 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10718-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10709-1 · Vendor Advisory