python311-Django-5.2.13-1.1 on GA media (moderate)

python311-Django-5.2.13-1.1 on GA media Announcement ID: openSUSE-SU-2026:10567-1 Rating: moderate Cross-References: CVE-2026-33033 CVE-2026-33034 CVE-2026-3902 CVE-2026-4277 CVE-2026-4292 CVSS scores: CVE-2026-33033 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2026-33033 SUSE : 6....

SUSE CVE-2026-3902

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants with hyphens or with underscores to a single version with underscores. Earlier, unsupported Django...

CVE-2026-3902 vulnerabilities

Vulnerabilities for packages: authentik, awx, label-studio, authentik-fips...

admin-auth0 (>=0.1.1, <=0.1.5), alcali (3006.3.0) +150 more potentially affected by CVE-2026-3902 via django (>=4.2.0, <=4.2.29)

django PYPI version =4.2.0, =0.1.1, =4.2.6.0, =65.10.0, =7.5.0a0, =1.1.0a0, =1.0.2, =0.0.1, =1.3.9, =0.4.0, =0.0.1, =4.16.2, =4.17.1 and more Source cves: CVE-2026-3902 Source advisory: OSV:GHSA-MVFQ-GGXM-9MC5...

admin-auth0 (>=0.1.1, <=0.1.5), alcali (3006.3.0) +150 more potentially affected by CVE-2026-3902 via django (>=4.2.0, <=4.2.29)

django PYPI version =4.2.0, =0.1.1, =4.2.6.0, =65.10.0, =7.5.0a0, =1.1.0a0, =1.0.2, =0.0.1, =1.3.9, =0.4.0, =0.0.1, =4.16.2, =4.17.1 and more Source cves: CVE-2026-3902 Source advisory: GHSA-MVFQ-GGXM-9MC5...

arthexis (>=0.1.3, <=2.0.0), cdm-ecommerce-backend (0.1.0) +67 more potentially affected by CVE-2026-3902 via django (>=5.2.0, <=5.2.12)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-3902 Source advisory: OSV:GHSA-MVFQ-GGXM-9MC5...

arthexis (>=0.1.3, <=2.0.0), cdm-ecommerce-backend (0.1.0) +67 more potentially affected by CVE-2026-3902 via django (>=5.2.0, <=5.2.12)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-3902 Source advisory: GHSA-MVFQ-GGXM-9MC5...

admin-auth0 (>=0.1.1, <=0.1.5), alcali (3006.3.0) +150 more potentially affected by CVE-2026-3902 via django (>=4.2.0, <=4.2.29)

django PYPI version =4.2.0, =0.1.1, =4.2.6.0, =65.10.0, =7.5.0a0, =1.1.0a0, =1.0.2, =0.0.1, =1.3.9, =0.4.0, =0.0.1, =4.16.2, =4.17.1 and more Source cves: CVE-2026-3902 Source advisory: OSV:PYSEC-2026-51...

arthexis (>=0.1.3, <=2.0.0), cdm-ecommerce-backend (0.1.0) +67 more potentially affected by CVE-2026-3902 via django (>=5.2.0, <=5.2.12)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-3902 Source advisory: OSV:PYSEC-2026-51...

CVE-2026-3902 ASGI header spoofing via underscore/hyphen conflation

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants with hyphens or with underscores to a single version with underscores. Earlier, unsupported Django...

admin-auth0 (>=0.1.1, <=0.1.5), alcali (3006.3.0) +150 more potentially affected by CVE-2026-3902 via django (>=4.2.0, <=4.2.29)

django PYPI version =4.2.0, =0.1.1, =4.2.6.0, =65.10.0, =7.5.0a0, =1.1.0a0, =1.0.2, =0.0.1, =1.3.9, =0.4.0, =0.0.1, =4.16.2, =4.17.1 and more Source cves: CVE-2026-3902 Source advisory: MEND:CVE-2026-3902...

arthexis (>=0.1.3, <=2.0.0), cdm-ecommerce-backend (0.1.0) +67 more potentially affected by CVE-2026-3902 via django (>=5.2.0, <=5.2.12)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-3902 Source advisory: MEND:CVE-2026-3902...

Linux Distros Unpatched Vulnerability : CVE-2026-3902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an...