Improper input validation in Django - CVE-2026-3902

Vulnerability identifier: #VU125093

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-3902

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to spoof security-sensitive headers.

The vulnerability exists due to improper input validation in ASGIRequest when processing request headers. A remote attacker can supply a header name with underscores to spoof security-sensitive headers.

This issue affects ASGI deployments where hyphenated and underscored header names may be treated ambiguously.

Django
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Fedora
Ubuntu
SUSE Package Hub 15
openSUSE Leap
openEuler
Anolis OS
python-django (Ubuntu package)
python311-Django
python-django
python3-Django
python-django-help
python3-django-doc
python3-django-bash-completion
python3-django
python-django4.2
python-django5
python-django6

Install security update from vendor's website.

Django - addressed in versions 4.2.30, 5.2.13, 6.0.4
python-django (Ubuntu package) - addressed in versions 1.6.11-0ubuntu1.3+esm11, 1.8.7-1ubuntu5.15+esm12, 1:1.11.11-1ubuntu1.21+esm15, 2:2.2.12-1ubuntu0.29+esm8, 2:3.2.12-2ubuntu1.26, 3:4.2.11-1ubuntu1.15, 3:5.2.4-1ubuntu2.4
python311-Django - update to 4.2.11-150600.3.56.1
python-django - update to 4.2.15-15
python3-Django - update to 4.2.15-15
python-django-help - update to 4.2.15-15
python3-django-doc - update to 4.2.30-1
python3-django-bash-completion - update to 4.2.30-1
python3-django - update to 4.2.30-1
python-django4.2 - update to 4.2.30-2.el9
python-django5 - addressed in versions 5.2.14-1.fc42, 5.2.14-1.fc43, 5.2.14-1.fc44
python-django6 - update to 6.0.5-1.fc44

• https://www.djangoproject.com/weblog/2026/apr/07/security-releases/

• Multiple vulnerabilities in Django
• Ubuntu update for python-django
• Ubuntu update for python-django
• Anolis OS update for python-django
• SUSE update for python-Django
• openEuler 24.03 LTS SP3 update for python-django
• openEuler 24.03 LTS SP1 update for python-django
• openEuler 24.03 LTS update for python-django
• openEuler 22.03 LTS SP4 update for python-django
• Fedora 44 update for python-django6
• Fedora 43 update for python-django5
• Fedora 44 update for python-django5
• Fedora 42 update for python-django5
• Fedora EPEL 9 update for python-django4.2