Log in Start free

Vulnerability · Published May 5, 2026 · Assigned by DSF

CVE-2026-35192Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST

Low 2.3

In plain English

A low-severity security flaw in Django from djangoproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24py3-django5.2.14-r0ALPINE-CVE-2026-35192
Debian:12python-djangono fix listedDEBIAN-CVE-2026-35192
Debian:13python-djangono fix listedDEBIAN-CVE-2026-35192
Debian:14python-django3:5.2.14-1DEBIAN-CVE-2026-35192
PyPIdjango5.2.14, 6.0.5PYSEC-2026-50
PyPIdjango5.2.14GHSA-7h2m-m8vj-598h
PyPIdjango6.0.5GHSA-7h2m-m8vj-598h
Ubuntu:22.04:LTSpython-django2:3.2.12-2ubuntu1.27UBUNTU-CVE-2026-35192
Ubuntu:24.04:LTSpython-django3:4.2.11-1ubuntu1.16UBUNTU-CVE-2026-35192
Ubuntu:25.10python-django3:5.2.4-1ubuntu2.5UBUNTU-CVE-2026-35192
Ubuntu:26.04:LTSpython-django3:5.2.9-0ubuntu4.1UBUNTU-CVE-2026-35192

Affected products (as reported)

VendorProductVersions
djangoproject Django 6.0 – before 6.0.55.2 – before 5.2.14

Weakness: CWE-539 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References