CVE-2026-35192

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.4 Django versions 5.2 through 5.2.13

Description When SESSION SAVE EVERY REQUEST is set to True, response headers do not vary based on cookies if a session remains unmodified. This allows a remote attacker to steal a user's session after the victim visits a cached public page. This is a session fixation issue where a session identifier can be compromised via public cached content.

Recommendations Update Django versions 6.0 through 6.0.4 to version 6.0.5. Update Django versions 5.2 through 5.2.13 to version 5.2.14.