MGASA-2026-0324

The updated package fixes security vulnerabilities: Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie. (CVE-2026-6873) Potential unencrypted email transmission via STARTTLS in the SMTP backend. (CVE-2026-7666) Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware. (CVE-2026-8404) Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware. (CVE-2026-35193) Potential exposure of private data via whitespace padding in Vary header. (CVE-2026-48587) Potential exposure of private data via cached Set-Cookie response. (CVE-2026-48588) Heap buffer over-read in GDALRaster. (CVE-2026-53877) Header injection possibility since DomainNameValidator accepted newlines in input. (CVE-2026-53878)