GitHub Advisoryadvisory · PyPI

GHSA-7h2m-m8vj-598h Django Uses Persistent Cookies Containing Sensitive Information

LOW Published 2026-05-05 Modified 2026-06-05 Official page ↗
Aliases
CVE-2026-35192
Ecosystem
PyPI
Packages
Django
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-539
Reviewed
2026-05-08

Affected packages

• PyPI Django: >= 6.0, < 6.0.5 → fixed in 6.0.5 • PyPI Django: >= 5.2, < 5.2.14 → fixed in 5.2.14

Description

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django thanks Cantina for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-35192 An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. vulnerability

Weakness · CWE (1)

  • CWE-539 Use of Persistent Cookies Containing Sensitive Information weakness

References