Django security releases issued: 6.0.5 and 5.2.14 | Weblog | Django
Title: Django security releases issued: 6.0.5 and 5.2.14
URL Source: https://www.djangoproject.com/weblog/2026/may/05/security-releases/
Published Time: 2026-05-05T09:00:00
Markdown Content:
Django security releases issued: 6.0.5 and 5.2.14 | Weblog | Django
Django The web framework for perfectionists with deadlines.
Menu Main navigation * Overview * Download * Documentation * News * Code * Issues * Community * Foundation * ♥ Donate
Search Submit
Toggle theme (current theme: auto)
Toggle theme (current theme: light)
Toggle theme (current theme: dark)
Toggle Light / Dark / Auto color theme
Until May 7, 2026, get PyCharm for 30% off!
Get 💸✨30%✨💸 off a new or renewal annual PyCharm Professional license while supporting the Django Software Foundation.
🎁 Now includes renewals, and every purchase helps fund the DSF. Get PyCharm for 30% off
Django security releases issued: 6.0.5 and 5.2.14
Posted by Sarah Boyce on May 5, 2026
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.5 and Django 5.2.14. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.
CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass
ASGI requests with a missing or understated Content-Length header could bypass the FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into memory and causing service degradation.
As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE.
This issue has severity "low" according to the Django security policy.
This issue was originally highlighted by Kyle Agronick in Trac. Thanks to Jacob Walls for following up and reporting it.
CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
Response headers did not vary on cookies if a session was not modified, but SESSION_SAVE_EVERY_REQUEST was True. A remote attacker could steal a user's session after that user visits a cached public page.
This issue has severity "low" according to the Django security policy.
CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware
Previously, django.middleware.cache.UpdateCacheMiddleware would erroneously cache requests where the Vary header contained an asterisk ('*'). This could lead to private data being stored and served.
This issue has severity "low" according to the Django security policy.
Thanks to Ahmad Sadeddin for the report.
Affected supported versions
- Django main
- Django 6.0
- Django 5.2
Resolution
Patches to resolve the issue have been applied to Django's main, 6.0, and 5.2 branches. The patches may be obtained from the following changesets.
CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass
- On the main branch
- On the 6.0 branch
- On the 5.2 branch
CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
- On the main branch
- On the 6.0 branch
- On the 5.2 branch
CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware
- On the main branch
- On the 6.0 branch
- On the 5.2 branch
The following releases have been issued
The PGP key ID used for this release is Sarah Boyce: 3955B19851EA96EF
General notes regarding security reporting
As always, we ask that potential security issues be reported via private email to [email protected], and not via Django's Trac instance, nor via the Django Forum. Please see our security policies for further information.
Additional Information
Support Django!
Upcoming Events
- DjangoCon US 2026Aug. 24, 2026 | Chicago, Illinois, USA 🇺🇸
Diamond and Platinum Members
Archives
Expand All / Collapse All * ## 2026
* [May 2026](https://www.djangoproject.com/weblog/2026/may/)
* [April 2026](https://www.djangoproject.com/weblog/2026/apr/)
* [March 2026](https://www.djangoproject.com/weblog/2026/mar/)
* [February 2026](https://www.djangoproject.com/weblog/2026/feb/)
* [January 2026](https://www.djangoproject.com/weblog/2026/jan/)
-
2025
-
2024
-
2023
-
2022
-
2021
-
2020
-
2019
-
2018
-
2017
-
2016
-
2015
-
2014
-
2013
-
2012
-
2011
-
2010
-
2009
-
2008
-
2007
-
2006
-
2005
RSS Feeds
Django Links
Learn More
- About Django
- Getting Started with Django
- Team Organization
- Django Software Foundation
- Code of Conduct
- Diversity Statement
Get Involved
Get Help
Follow Us
Support Us
- Hosting byIn-kind donors
- Design byThreespot&andrevv
© 2005-2026 Django Software Foundation and individual contributors. Django is a registered trademark of the Django Software Foundation.