CVE-2026-7666

Katalog CVE

CVSS 3.1 · Low EPSS 0,21%

Kerentanan Cleartext Transmission of Sensitive Information pada djangoproject django. Skor CVSS 3.1 3.1 (Low) menurut CNA.

Deskripsi (NVD)

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.

Rincian

Terbit di NVD

3 Juni 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

3.1 (Low), sumber CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-319: Cleartext Transmission of Sensitive Information

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.djangoproject.com/en/dev/releases/security/ patch · advisory vendor
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases/ patch · advisory vendor
• https://groups.google.com/g/django-announce release notes