PT-2026-45948 · Django Software Foundation · Django

Jake Howard + 2 · Published 2026-06-03 · Updated 2026-06-06 · CVE-2026-7666

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.0.6 Django versions prior to 5.2.15

Description An issue exists in django.core.mail.backends.smtp.EmailBackend where the system fails to prevent the reuse of a partially-initialized connection following a failed STARTTLS handshake when the fail silently variable is set to True. This allows on-path network attackers to intercept and read email content in cleartext.

Recommendations Update to version 6.0.6 or later. Update to version 5.2.15 or later.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BIT-DJANGO-2026-7666

CVE-2026-7666

PYSEC-2026-200

Affected Products

Django

References · 8

• https://osv.dev/vulnerability/PYSEC-2026-200 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-django-2026-7666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7666 · Security Note
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://djangoproject.com/weblog/2026/jun/03/security-releases · Vendor Advisory
• https://t.me/CVEtracker/55726 · Telegram Post
• https://groups.google.com/g/django-announce · Note
• https://twitter.com/oss_security/status/2063112604545913330 · Twitter Post