CVE-2026-3902 — Authentication Bypass by Spoofing

Vendor	Product	Version range	Fixed in
debian	python-django	< python-django 3:4.2.30-1 (sid)	python-django 3:4.2.30-1 (sid)
djangoproject	django	>= 4.2 < 4.2.30	4.2.30
djangoproject	django	>= 4.2 < 4.2.30	4.2.30
djangoproject	django	>= 5.2 < 5.2.13	5.2.13
djangoproject	django	>= 5.2 < 5.2.13	5.2.13
djangoproject	django	>= 6.0 < 6.0.4	6.0.4
djangoproject	django	>= 6.0 < 6.0.4	6.0.4

Ubuntu

Django vulnerabilities

vendor_ubuntu·2026-04-09·CVSS 6.5

CVE-2026-33033 [MEDIUM] Django vulnerabilities Title: Django vulnerabilities Summary: Several security issues were fixed in Django. USN-8154-1 fixed vulnerabilities in Django. This update provides the corresponding updates for Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. Original advisory details: Seokchan Yoon discovered that Django incorrectly handled copying memory when parsing multipart uploads with excessive whitespace. A remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a denial of service. (CVE-2026-33033) It was discovered that Django did not enforce an upload memory size limit in the Content-Length header. A remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubun

Ubuntu

Django vulnerabilities

vendor_ubuntu·2026-04-07·CVSS 6.5

CVE-2026-33033 [MEDIUM] Django vulnerabilities Title: Django vulnerabilities Summary: Several security issues were fixed in Django. Seokchan Yoon discovered that Django incorrectly handled copying memory when parsing multipart uploads with excessive whitespace. A remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a denial of service. (CVE-2026-33033) It was discovered that Django did not enforce an upload memory size limit in the Content-Length header. A remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-33034) Tarek Nakkouch discovered that Django incorrectly handled underscores in the ASGI headers. A remote attacker could possibly use this is

Red Hat

Django: Django: Header spoofing via ambiguous header mapping

vendor_redhat·2026-04-07·CVSS 7.5

CVE-2026-3902 [HIGH] CWE-444 Django: Django: Header spoofing via ambiguous header mapping Django: Django: Header spoofing via ambiguous header mapping A flaw was found in Django. A remote attacker can exploit an ambiguous mapping of header variants (with hyphens or underscores) to a single version with underscores in `ASGIRequest`. This vulnerability allows the attacker to spoof headers, potentially leading to unauthorized actions or misdirection within the application. Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Package: automation-controller (Red Hat Ansible Automation Platform 2) - Fix deferred Package: redhat-user-workloads/automation-reports (Red Hat Ansible Automation P

Debian

CVE-2026-3902: python-django - An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4...

vendor_debian·2026·CVSS 7.5

CVE-2026-3902 [HIGH] CVE-2026-3902: python-django - An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4... An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue. Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 3:4.2.30-1) trixie: open

OSV

Django vulnerable to ASGI header spoofing via underscore/hyphen conflation

osv·2026-04-07

CVE-2026-3902 [HIGH] Django vulnerable to ASGI header spoofing via underscore/hyphen conflation Django vulnerable to ASGI header spoofing via underscore/hyphen conflation An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

GHSA

Django vulnerable to ASGI header spoofing via underscore/hyphen conflation

ghsa·2026-04-07

CVE-2026-3902 [HIGH] CWE-290 Django vulnerable to ASGI header spoofing via underscore/hyphen conflation Django vulnerable to ASGI header spoofing via underscore/hyphen conflation An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

OSV

CVE-2026-3902: An issue was discovered in 6

osv·2026-04-07·CVSS 7.5

CVE-2026-3902 [HIGH] CVE-2026-3902: An issue was discovered in 6 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

OSV

CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation

osv·2026-04-07·CVSS 7.5

CVE-2026-3902 [HIGH] CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ASGI header spoofing via underscore/hyphen conflation

OSV

python-django vulnerabilities

osv·2026-04-07·CVSS 6.5

CVE-2026-33033 [MEDIUM] python-django vulnerabilities python-django vulnerabilities Seokchan Yoon discovered that Django incorrectly handled copying memory when parsing multipart uploads with excessive whitespace. A remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a denial of service. (CVE-2026-33033) It was discovered that Django did not enforce an upload memory size limit in the Content-Length header. A remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-33034) Tarek Nakkouch discovered that Django incorrectly handled underscores in the ASGI headers. A remote attacker could possibly use this issue to spoof HTTP headers. This issue only affected Ubun

CVE-2026-3902: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an…

Affected

CVSS provenance