Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099457 advisory. An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated Content-Length header can bypass the...

asgi-request-duration (>=0.1.0, <=0.1.1), starlette-authlib (>=0.3.5, <=0.3.6) potentially affected by CVE-2026-54282 via starlette (0.42.0)

starlette PYPI version 0.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =0.1.0, =0.3.5, =0.3.6 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

asgi-request-duration (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-54282 via starlette (0.43.0)

starlette PYPI version 0.43.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =1.0.0, =1.0.3 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

asgi-request-duration (>=0.1.0, <=0.1.1), starlette-authlib (>=0.3.5, <=0.3.6) potentially affected by CVE-2026-48817 via starlette (0.42.0)

starlette PYPI version 0.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =0.1.0, =0.3.5, =0.3.6 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

asgi-request-duration (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-48817 via starlette (0.43.0)

starlette PYPI version 0.43.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =1.0.0, =1.0.3 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

asgi-request-duration (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-48818 via starlette (0.43.0)

starlette PYPI version 0.43.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =1.0.0, =1.0.3 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

asgi-request-duration (>=0.1.0, <=0.1.1), starlette-authlib (>=0.3.5, <=0.3.6) potentially affected by CVE-2026-48818 via starlette (0.42.0)

starlette PYPI version 0.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =0.1.0, =0.3.5, =0.3.6 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

asgi-request-duration (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-54282 via starlette (0.43.0)

starlette PYPI version 0.43.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =1.0.0, =1.0.3 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

asgi-request-duration (>=0.1.0, <=0.1.1), starlette-authlib (>=0.3.5, <=0.3.6) potentially affected by CVE-2026-54282 via starlette (0.42.0)

starlette PYPI version 0.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =0.1.0, =0.3.5, =0.3.6 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

asgi-request-duration (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-48818 via starlette (0.43.0)

starlette PYPI version 0.43.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =1.0.0, =1.0.3 Source cves: CVE-2026-48818 Source advisory: OSV:GHSA-WQP7-X3PW-XC5R...

asgi-request-duration (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-48817 via starlette (0.43.0)

starlette PYPI version 0.43.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =1.0.0, =1.0.3 Source cves: CVE-2026-48817 Source advisory: OSV:GHSA-X746-7M8F-X49C...

asgi-request-duration (>=0.1.0, <=0.1.1), starlette-authlib (>=0.3.5, <=0.3.6) potentially affected by CVE-2026-48817 via starlette (0.42.0)

starlette PYPI version 0.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =0.1.0, =0.3.5, =0.3.6 Source cves: CVE-2026-48817 Source advisory: OSV:GHSA-X746-7M8F-X49C...

asgi-request-duration (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-48710 via starlette (0.43.0)

starlette PYPI version 0.43.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =1.0.0, =1.0.3 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

asgi-request-duration (>=0.1.0, <=0.1.1), starlette-authlib (>=0.3.5, <=0.3.6) potentially affected by CVE-2026-48710 via starlette (0.42.0)

starlette PYPI version 0.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =0.1.0, =0.3.5, =0.3.6 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

asgi-request-duration (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-48710 via starlette (0.43.0)

starlette PYPI version 0.43.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =1.0.0, =1.0.3 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

OESA-2026-2218 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads wi...

Django: Django: Denial of Service via crafted request with duplicate headers

A flaw was found in Django. A remote attacker can exploit this vulnerability by sending a crafted request containing multiple duplicate headers to the ASGIRequest component. This can lead to a potential Denial of Service DoS, making the affected system unavailable to legitimate users...

BIT-DJANGO-2026-3902 ASGI header spoofing via underscore/hyphen conflation

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants with hyphens or with underscores to a single version with underscores. Earlier, unsupported Django...

SUSE CVE-2026-3902

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants with hyphens or with underscores to a single version with underscores. Earlier, unsupported Django...

CVE-2026-3902

A flaw was found in Django. A remote attacker can exploit an ambiguous mapping of header variants with hyphens or underscores to a single version with underscores in ASGIRequest. This vulnerability allows the attacker to spoof headers, potentially leading to unauthorized actions or misdirection...