What were the notable Django updates?

Added CVE-2026-5766, CVE-2026-35192, and CVE-2026-6907 to security archive, Fixed CVE-2026-6907 -- Prevented caching of requests when Vary header contains an asterisk, and Fixed CVE-2026-35192 -- Ensured Vary header is sent when setting session cookie with SESSION_SAVE_EVERY_REQUEST=True.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO PATCHES THREE CRITICAL CACHE AND UPLOAD VULNERABILITIES

By RepoJournal · Filed 06:00 UTC on May 6, 2026 · About Django

Django shipped fixes overnight for three security flaws affecting cache headers, session handling, and ASGI file uploads that could let attackers bypass critical safety limits.

Three CVEs hit the archive simultaneously [1], each addressing a distinct attack surface. CVE-2026-6907 [2] fixes a cache poisoning vulnerability where requests with wildcard Vary headers were being cached when they shouldn't be — a bypass that could serve stale data to the wrong users. CVE-2026-35192 [3] ensures the Vary header is actually sent when SESSION_SAVE_EVERY_REQUEST=True, preventing session fixation attacks in certain configurations. The most dangerous is CVE-2026-5766 [4], which exploits ASGI deployments specifically: attackers could declare a small Content-Length header while uploading massive files, bypassing DATA_UPLOAD_MAX_MEMORY_SIZE entirely and crashing your workers. The ASGI vulnerability is critical if you're running Django on async servers — the fix enforces memory limits regardless of what the client claims to be sending.

Action items

→ Patch immediately if running ASGI deployments (CVE-2026-5766) django/django [immediate]
→ Upgrade all Django instances for CVE-2026-6907 and CVE-2026-35192 django/django [immediate]
→ Verify SESSION_SAVE_EVERY_REQUEST=True configs are protected django/django [plan]

References

[1] Added CVE-2026-5766, CVE-2026-35192, and CVE-2026-6907 to security archive. django/django
[2] Fixed CVE-2026-6907 -- Prevented caching of requests when Vary header contains an asterisk. django/django
[3] Fixed CVE-2026-35192 -- Ensured Vary header is sent when setting session cookie with SESSION_SAVE_EVERY_REQUEST=True. django/django
[4] Fixed CVE-2026-5766 -- Enforced DATA_UPLOAD_MAX_MEMORY_SIZE in MemoryFileUploadHandler on ASGI. django/django

Quick answers

What shipped in Django on May 6, 2026?: Django shipped fixes overnight for three security flaws affecting cache headers, session handling, and ASGI file uploads that could let attackers bypass critical safety limits. In total, 7 commits and 1 pull requests landed.
What were the notable Django updates?: Added CVE-2026-5766, CVE-2026-35192, and CVE-2026-6907 to security archive, Fixed CVE-2026-6907 -- Prevented caching of requests when Vary header contains an asterisk, and Fixed CVE-2026-35192 -- Ensured Vary header is sent when setting session cookie with SESSION_SAVE_EVERY_REQUEST=True.

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 1 day ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 2 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 3 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.