CVE-2026-3902

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3, 5.2 through 5.2.12, and 4.2 through 4.2.29

Description The ASGIRequest component allows a remote attacker to spoof headers due to an ambiguous mapping of header variants (with hyphens or with underscores) to a single version with underscores.

Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.