{"id":"CVE-2026-35192","title":"An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nResponse headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`","summary":"An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nResponse headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cwe":["CWE-539"],"vendor":"djangoproject","product":"django","affected":["django >= 5.2, < 5.2.14","django >= 6.0, < 6.0.5"],"patched":["django 6.0.5"],"published":"2026-05-05","updated":"2026-06-17","sourceUpdated":"2026-06-17T10:40:11.073","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35192","references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","label":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://groups.google.com/g/django-announce","label":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://www.djangoproject.com/weblog/2026/may/05/security-releases/","label":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"tags":["nvd","cve.org","score-dispute"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-05-05T17:04:02.535125Z"},"scores":{"nvd":6.5,"cna":2.3},"ingestedAt":"2026-09-13T09:17:22.884Z","epss":0.00544,"epssPercentile":0.44337,"slug":"CVE-2026-35192","body":"## Overview\n\nAn issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nResponse headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.\n\n## Affected\n\n- `django >= 5.2, < 5.2.14`\n- `django >= 6.0, < 6.0.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `django 6.0.5`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}