Security update for python-Django
This update for python-Django fixes the following issues - CVE-2026-6873: signed cookie salt namespace collision in `django.http.HttpRequest.get_signed_cookie` (bsc#1267578). - CVE-2026-7666: potential unencrypted email transmission via `STARTTLS` in the SMTP backend (bsc#1267579). - CVE-2026-8404: potential exposure of private data via case-sensitive `Cache-Control` directives in `UpdateCacheMiddleware` (bsc#1267580). - CVE-2026-35193: potential exposure of private data via missing `Vary: Authorization` in `UpdateCacheMiddleware` (bsc#1267576). - CVE-2026-48587: potential exposure of private data via whitespace padding in `Vary` header (bsc#1267577).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for python-Django fixes the following issues - CVE-2026-6873: signed cookie salt namespace collision in `django.http.HttpRequest.get_signed_cookie` (bsc#1267578). - CVE-2026-7666: potential unencrypted email transmission via `STARTTLS` in the SMTP backend (bsc#1267579). - CVE-2026-8404: potential exposure of private data via case-sensitive `Cache-Control` directives in `UpdateCacheMiddleware` (bsc#1267580). - CVE-2026-35193: potential exposure of private data via missing `Vary: Authorization` in `UpdateCacheMiddleware` (bsc#1267576). - CVE-2026-48587: potential exposure of private data via whitespace padding in `Vary` header (bsc#1267577).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1267576
- https://bugzilla.suse.com/1267577
- https://bugzilla.suse.com/1267578
- https://bugzilla.suse.com/1267579
- https://bugzilla.suse.com/1267580
- https://www.suse.com/security/cve/CVE-2026-35193
- https://www.suse.com/security/cve/CVE-2026-48587
- https://www.suse.com/security/cve/CVE-2026-6873
- https://www.suse.com/security/cve/CVE-2026-7666
- https://www.suse.com/security/cve/CVE-2026-8404
- https://www.suse.com/support/update/announcement/2026/suse-su-20262318-1/