---
id: CVE-2026-35192
title: >-
  An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.

  Response headers do not vary on cookies if a session is not modified, but
  `SESSION_SAVE_EVERY_REQUEST` is `True`
summary: >-
  An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.

  Response headers do not vary on cookies if a session is not modified, but
  `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's
  session after that …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-539
vendor: djangoproject
product: django
affected:
  - 'django >= 5.2, < 5.2.14'
  - 'django >= 6.0, < 6.0.5'
patched:
  - django 6.0.5
published: '2026-05-05'
updated: '2026-06-17'
sourceUpdated: '2026-06-17T10:40:11.073'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-35192'
references:
  - url: 'https://docs.djangoproject.com/en/dev/releases/security/'
    label: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
  - url: 'https://groups.google.com/g/django-announce'
    label: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
  - url: 'https://www.djangoproject.com/weblog/2026/may/05/security-releases/'
    label: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
tags:
  - nvd
  - cve.org
  - score-dispute
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-05T17:04:02.535125Z'
scores:
  nvd: 6.5
  cna: 2.3
ingestedAt: '2026-09-13T09:17:22.884Z'
epss: 0.00544
epssPercentile: 0.44578
---

## Overview

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Cantina for reporting this issue.

## Affected

- `django >= 5.2, < 5.2.14`
- `django >= 6.0, < 6.0.5`

## Remediation

Upgrade past the affected range:

- `django 6.0.5`