Is there a patch available for CVE-2026-35192?

Yes, a patch is available for CVE-2026-35192. Update the affected software to the latest version immediately.

Django CVE-2026-35192

Q: What is the CVSS score of CVE-2026-35192?

CVE-2026-35192 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27347 LOW

Use of Persistent Cookies Containing Sensitive Information (CWE-539)

2026-05-05 DSF

Python Information Disclosure

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 16:32 vuln.today

CVSS changed

May 05, 2026 - 16:22 NVD

2.3 (LOW)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

12 pypi packages depend on django (12 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.2.

DescriptionCVE.org

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but SESSION_SAVE_EVERY_REQUEST is True. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

AnalysisAI

Django 6.0 before 6.0.5 and 5.2 before 5.2.14 fail to vary response headers on session cookies when SESSION_SAVE_EVERY_REQUEST is enabled but the session is unmodified, allowing remote attackers with user interaction to steal session tokens from cached public pages. The vulnerability affects server configurations that cache responses aggressively while maintaining per-request session handling, exposing authenticated users to session hijacking after visiting pages served from cache.

Technical ContextAI

Django's session middleware is responsible for managing user authentication state via HTTP cookies and server-side session storage. When SESSION_SAVE_EVERY_REQUEST is set to True, Django updates the session record on every request even if the session data has not changed. However, the vulnerability stems from improper cache control headers - specifically the Vary header - which informs HTTP caches whether response variations depend on request headers (including cookies). When SESSION_SAVE_EVERY_REQUEST is True but the session is unmodified, Django fails to include the session cookie in the Vary header, causing HTTP caches (proxies, CDNs, browsers) to cache and serve the same response to multiple users regardless of their session cookie. This violates the caching contract and allows subsequent users accessing the cached public page to inherit the previous user's session cookie if the cache is poisoned or misconfigured. The root cause is classified under CWE-539 (Information Exposure Through Persistent Cookies), a cookie handling vulnerability.

RemediationAI

Upgrade to Django 6.0.5 or later for the 6.0 series, or Django 5.2.14 or later for the 5.2 series. Users on unsupported versions (5.0.x, 4.1.x, 3.2.x) should upgrade to a supported version. As a temporary workaround on unpatched systems, disable SESSION_SAVE_EVERY_REQUEST by setting it to False in Django settings (the default), which forces Django to emit proper Vary headers on session cookies and prevents cache poisoning. Alternatively, configure HTTP cache layers (reverse proxies, CDNs) to exclude pages with session cookies from caching, or use cache control directives (Cache-Control: no-cache) on authenticated responses. Organizations should verify that their caching layer respects Vary headers; misconfigured reverse proxies or CDNs that ignore Vary directives remain vulnerable even with the patch. See Django's official security advisory at https://www.djangoproject.com/weblog/2026/may/05/security-releases/ and https://docs.djangoproject.com/en/dev/releases/security/ for details.