GHSA-2mcm-79hx-8fxw

Source

https://github.com/advisories/GHSA-2mcm-79hx-8fxw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-2mcm-79hx-8fxw/GHSA-2mcm-79hx-8fxw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2mcm-79hx-8fxw

Aliases

Related

CGA-5wcc-7wx7-j93f

Published

2026-02-03T15:30:23Z

Modified

2026-02-05T10:25:58.010797Z

Severity

2.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Django has Observable Timing Discrepancy

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

The django.contrib.auth.handlers.modwsgi.check_password() function for authentication via mod_wsgi allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Stackered for reporting this issue.

Database specific

{
    "nvd_published_at": "2026-02-03T15:16:11Z",
    "cwe_ids": [
        "CWE-208"
    ],
    "github_reviewed_at": "2026-02-03T19:22:54Z",
    "severity": "LOW",
    "github_reviewed": true
}

References

Affected packages

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0a1

Fixed

6.0.2

Affected versions

6.*

6.0a1

6.0b1

6.0rc1

6.0

6.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-2mcm-79hx-8fxw/GHSA-2mcm-79hx-8fxw.json"

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.2a1

Fixed

5.2.11

Affected versions

5.*

5.2a1

5.2b1

5.2rc1

5.2

5.2.1

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

5.2.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-2mcm-79hx-8fxw/GHSA-2mcm-79hx-8fxw.json"

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.2a1

Fixed

4.2.28

Affected versions

4.*

4.2a1

4.2b1

4.2rc1

4.2

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.2.8

4.2.9

4.2.10

4.2.11

4.2.12

4.2.13

4.2.14

4.2.15

4.2.16

4.2.17

4.2.18

4.2.19

4.2.20

4.2.21

4.2.22

4.2.23

4.2.24

4.2.25

4.2.26

4.2.27

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-2mcm-79hx-8fxw/GHSA-2mcm-79hx-8fxw.json"