BIT-django-2026-7666

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2026-7666.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-django-2026-7666
Aliases
Published
2026-06-06T08:39:24.753Z
Modified
2026-06-06T10:41:13.098774294Z
Summary
Potential unencrypted email transmission via STARTTLS in the SMTP backend
Details

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.core.mail.backends.smtp.EmailBackend in Django fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake when fail_silently=True, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.

Database specific 
{
    "severity": "Low",
    "cpes": [
        "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"
    ]
}
References

Affected packages

Bitnami / django

Package

Name
django
Purl
pkg:bitnami/django

Severity

  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
5.2.0
Fixed
5.2.15
Introduced
6.0.0
Fixed
6.0.6

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2026-7666.json"