- Description
- An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.
- Source
- 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- NVD status
- Analyzed
- Products
- django
CVSS 4.0
- Type
- Secondary
- Base score
- 2.3
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- LOW
CVSS 3.1
- Type
- Secondary
- Base score
- 3.1
- Impact score
- 1.4
- Exploitability score
- 1.6
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- Severity
- LOW
- 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- CWE-319
- Hype score
- Not currently trending
5 CVEs in Django https://t.co/PCZNkRyzZI CVE-2026-6873: Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend + next tweet
@oss_security
6 Jun 2026
997 Impressions
2 Retweets
6 Likes
0 Bookmarks
1 Reply
0 Quotes
June Django security release: 4 CVEs spanning cache middleware (CVE-2026-8404, CVE-2026-48587), STARTTLS downgrade in EmailBackend (CVE-2026-7666), signed cookie salt collision (CVE-2026-6873). Fix the STARTTLS one first. https://t.co/HpnyHhXXnp
@BunSnack
5 Jun 2026
6 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
"matchCriteriaId": "048C450F-F81F-4A1D-9BF7-DC36FF26988E",
"versionEndExcluding": "5.2.15",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BC9BA685-D9CE-406E-A479-9C444E8EADB3",
"versionEndExcluding": "6.0.6",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]