CVE-2026-3902

A flaw was found in Django. A remote attacker can exploit an ambiguous mapping of header variants with hyphens or underscores to a single version with underscores in ASGIRequest. This vulnerability allows the attacker to spoof headers, potentially leading to unauthorized actions or misdirection...

CVE-2026-3902

The CVE-2026-3902 entry describes a header-spoofing issue in Django with ASGIRequest, caused by ambiguous mapping of header names that can be hyphenated or underscored. Affected are Django releases: 6.0 up to 6.0.4, 5.2 up to 5.2.13, and 4.2 up to 4.2.30. The vulnerability allows a remote attacke...