diff options
| author | Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> | 2026-05-05 16:30:51 +0200 |
|---|---|---|
| committer | Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> | 2026-05-05 16:30:51 +0200 |
| commit | 17b93fa0816e13878646200ca4e0c38871b52e78 (patch) | |
| tree | 078053daafdd785ba4172cb94cad2a6548f8d003 /docs | |
| parent | fcfc4b2fe9f0aa8b3015db14081ce990dc25ed9f (diff) | |
Added CVE-2026-5766, CVE-2026-35192, and CVE-2026-6907 to security archive.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/security.txt | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/docs/releases/security.txt b/docs/releases/security.txt index b689d90f1d..fc79d72d25 100644 --- a/docs/releases/security.txt +++ b/docs/releases/security.txt @@ -36,6 +36,38 @@ Issues under Django's security process All security issues have been handled under versions of Django's security process. These are listed below. +May 5, 2026 - :cve:`2026-5766` +------------------------------ + +Potential denial-of-service vulnerability in ASGI requests via file upload +limit bypass. +`Full description +<https://www.djangoproject.com/weblog/2026/may/05/security-releases/>`__ + +* Django 6.0 :commit:`(patch) <ad8f9e19e0897ea45ded7c046ff28daf6f773e92>` +* Django 5.2 :commit:`(patch) <2ec27eda3ba6c14f0856e6e3eb1df07c41fd95e6>` + +May 5, 2026 - :cve:`2026-35192` +------------------------------- + +Session fixation via public cached pages and ``SESSION_SAVE_EVERY_REQUEST``. +`Full description +<https://www.djangoproject.com/weblog/2026/may/05/security-releases/>`__ + +* Django 6.0 :commit:`(patch) <1b0184aa657bc3f5859aeb0206e7c1e94e48b103>` +* Django 5.2 :commit:`(patch) <47cf968c125e3fab317e10fe150ec479e745f995>` + +May 5, 2026 - :cve:`2026-6907` +------------------------------ + +Potential exposure of private data due to incorrect handling of ``Vary: *`` in +``UpdateCacheMiddleware``. +`Full description +<https://www.djangoproject.com/weblog/2026/may/05/security-releases/>`__ + +* Django 6.0 :commit:`(patch) <44ad76efcbe3c4ca0f08bb9dabe916f6374596c9>` +* Django 5.2 :commit:`(patch) <2115d4eaee15107f5cd290d7cfcc5ffe3ad43661>` + April 7, 2026 - :cve:`2026-3902` -------------------------------- |