Sign in
Deutsch English Español Polski
Low

Django: signed cookies are vulnerable to salt namespace collisions

  • Disclosed: 03.06.2026
  • Updated: 11.10.2026 15:17

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.http.HttpRequest.get_signed_cookie in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct (name, salt) pairs that produce the same concatenation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Peng Zhou for reporting this issue.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) django < 5.2.15, >= 6.0.0, < 6.0.6 5.2.15, 6.0.6

References

CVSS score 3.1/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE)
CWE-347
Platform
Python (PyPI)
Package
django
Disclosed
03.06.2026
Updated
11.10.2026 15:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-199 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-h7pc-vwp9-298g - CC BY 4.0

Vulnerability history: django

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (162) in the archive
Total entries
162
First → latest
10.2007 08.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 16
  • High 65
  • Medium 63
  • Low 18

Disclosures per year

earlier: 56

Severity:
  1. Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
    High · 8.8 CVE-2026-15307 < 5.2.17, >= 6.0a1, < 6.0.8 5.2.17, 6.0.8
  2. Django: signed cookies are vulnerable to salt namespace collisions this entry
    Low · 3.1 CVE-2026-6873 < 5.2.15, >= 6.0.0, < 6.0.6 5.2.15, 6.0.6
  3. Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
    High · 7.5 CVE-2026-3902 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  4. Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
    High · 7.5 CVE-2026-33034 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  5. Django vulnerable to Uncontrolled Resource Consumption
    High · 7.5 CVE-2026-25673 >= 6.0, < 6.0.3, >= 5.2, < 5.2.12, >= 4.2, < 4.2.29 6.0.3, 5.2.12, 4.2.29
  6. Django has an SQL Injection issue
    High CVE-2026-1287 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  7. Django has an SQL Injection issue
    High CVE-2026-1207 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  8. An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
    Critical · 9.1 CVE-2025-64459 >= 4.2, < 4.2.26, >= 5.1, < 5.1.14, >= 5.2, < 5.2.8 4.2.26, 5.1.14, 5.2.8
  9. Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
    High · 7.5 CVE-2025-64458 >= 5.2a1, < 5.2.8, >= 5.0a1, < 5.1.14, < 4.2.26 5.2.8, 5.1.14, 4.2.26
  10. Django vulnerable to SQL injection in column aliases
    High · 7.1 CVE-2025-59681 >= 4.2, < 4.2.25, >= 5.1, < 5.1.13, >= 5.2, < 5.2.7 4.2.25, 5.1.13, 5.2.7
  11. Django is subject to SQL injection through its column aliases
    High · 7.1 CVE-2025-57833 < 4.2.24, >= 5.0a1, < 5.1.12, >= 5.2a1, < 5.2.6 4.2.24, 5.1.12, 5.2.6
  12. Django SQL injection in HasKey(lhs, rhs) on Oracle
    High · 9.8 CVE-2024-53908 >= 5.0.0, < 5.0.10, >= 5.1.0, < 5.1.4, >= 4.2.0, < 4.2.17, >= 5.1, < 5.1.4, >= 5.0, < 5.0.10, >= 4.2, < 4.2.17 5.0.10, 5.1.4, 4.2.17
  13. An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a cr
    Critical · 9.1 CVE-2024-42005 >= 5.0, < 5.0.8, >= 4.2, < 4.2.15 5.0.8, 4.2.15
  14. Django vulnerable to Denial of Service
    High · 7.5 CVE-2024-39614 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  15. Django Path Traversal vulnerability
    High · 7.5 CVE-2024-39330 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  16. Django vulnerable to Denial of Service
    High · 7.5 CVE-2024-38875 >= 4.2, < 4.2.14, >= 5.0, < 5.0.7 4.2.14, 5.0.7
  17. Django denial-of-service attack in the intcomma template filter
    High · 5.9 CVE-2024-24680 >= 3.2, < 3.2.24, >= 4.2, < 4.2.10, >= 5.0, < 5.0.2 3.2.24, 4.2.10, 5.0.2
  18. In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of s
    High · 5.9 CVE-2023-43665 >= 3.2, < 3.2.22, >= 4.1, < 4.1.12, >= 4.2, < 4.2.6 3.2.22, 4.1.12, 4.2.6
  19. An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is su
    High · 7.5 CVE-2023-46695 >= 3.2, < 3.2.23, >= 4.1, < 4.1.13, >= 4.2, < 4.2.7 3.2.23, 4.1.13, 4.2.7
  20. In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large numb
    High · 7.5 CVE-2023-36053 >= 4.2, < 4.2.3, >= 4.0, < 4.1.10, >= 3.2, < 3.2.20 4.2.3, 4.1.10, 3.2.20
  21. In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been suppor
    Critical · 9.8 CVE-2023-31047 >= 3.2, < 3.2.19, >= 4.0, < 4.1.9, >= 4.2, < 4.2.1 3.2.19, 4.1.9, 4.2.1
  22. An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart f
    High · 7.5 CVE-2023-24580 >= 3.2, < 3.2.18, >= 4.0, < 4.0.10, >= 4.1, < 4.1.7 3.2.18, 4.0.10, 4.1.7
  23. In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-s
    High · 7.5 CVE-2023-23969 >= 3.2, < 3.2.17, >= 4.0, < 4.0.9, >= 4.1, < 4.1.6 3.2.17, 4.0.9, 4.1.6
  24. In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular
    High · 7.5 CVE-2022-41323 >= 3.2, < 3.2.16, >= 4.0, < 4.0.8, >= 4.1, < 4.1.2 3.2.16, 4.0.8, 4.1.2
  25. Django vulnerable to Reflected File Download attack
    High · 8.8 CVE-2022-36359 < 3.2.15, >= 4.0, < 4.0.7 3.2.15, 4.0.7
  26. Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
    Critical · 9.8 CVE-2022-34265 >= 3.2a1, < 3.2.14, >= 4.0a1, < 4.0.6 3.2.14, 4.0.6
  27. Django Arbitrary Code Execution
    High CVE-2007-0404 >= 0.95, < 1.0 1.0
  28. SQL Injection in Django
    Critical · 9.8 CVE-2022-28347 >= 2.2, < 2.2.28, >= 3.2, < 3.2.13, >= 4.0, < 4.0.4 2.2.28, 3.2.13, 4.0.4
  29. SQL Injection in Django
    Critical · 9.8 CVE-2022-28346 >= 2.2, < 2.2.28, >= 3.2, < 3.2.13, >= 4.0, < 4.0.4 2.2.28, 3.2.13, 4.0.4
  30. Infinite Loop in Django
    High · 7.5 CVE-2022-23833 >= 2.2, < 2.2.27, >= 3.2, < 3.2.12, >= 4.0, < 4.0.2 2.2.27, 3.2.12, 4.0.2
  31. Information disclosure in Django
    High · 7.5 CVE-2021-45116 >= 2.2, < 2.2.26, >= 3.2, < 3.2.11, >= 4.0, < 4.0.1 2.2.26, 3.2.11, 4.0.1
  32. Denial-of-service in Django
    High · 7.5 CVE-2021-45115 >= 2.2a1, < 2.2.26, >= 3.2a1, < 3.2.11, >= 4.0a1, < 4.0.1 2.2.26, 3.2.11, 4.0.1
  33. SQL Injection in Django
    Critical · 9.8 CVE-2021-35042 >= 3.2a1, < 3.2.5, >= 3.0a1, < 3.1.13 3.2.5, 3.1.13
  34. Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks
    High · 7.5 CVE-2021-33571 >= 2.2a1, < 2.2.24, >= 3.0a1, < 3.1.12, >= 3.2a1, < 3.2.4 2.2.24, 3.1.12, 3.2.4
  35. Path Traversal in Django
    High · 7.5 CVE-2021-31542 >= 2.2, < 2.2.21, >= 3.0, < 3.1.9, >= 3.2, < 3.2.1 2.2.21, 3.1.9, 3.2.1
  36. Django Incorrect Default Permissions
    High · 7.5 CVE-2020-24583 >= 2.2a1, < 2.2.16, >= 3.0a1, < 3.0.10, >= 3.1a1, < 3.1.1 2.2.16, 3.0.10, 3.1.1
  37. Data leakage via cache key collision in Django
    High · 5.9 CVE-2020-13254 >= 2.2, < 2.2.13, >= 3.0, < 3.0.7 2.2.13, 3.0.7
  38. Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suit
    High · 8.8 CVE-2020-9402 >= 1.11, < 1.11.29, >= 2.2, < 2.2.11, >= 3.0, < 3.0.4 1.11.29, 2.2.11, 3.0.4
  39. SQL injection in Django
    Critical · 9.8 CVE-2020-7471 < 1.11.28, >= 2.0, < 2.2.10, >= 3.0, < 3.0.3 1.11.28, 2.2.10, 3.0.3
  40. Django Potential account hijack via password reset form
    Critical · 9.8 CVE-2019-19844 < 1.11.27, >= 2.0, < 2.2.9, >= 3.0, < 3.0.1 1.11.27, 2.2.9, 3.0.1
Show more (20) Showing 40 of 82

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.