{"title":"Django 5.2.14 release notes","version":"dev","locale":"en","docname":"releases/5.2.14","url":"/en/dev/releases/5.2.14/","canonical":"https://djangodocs.dev/en/dev/releases/5.2.14/","summary":"Django 5.2.14 fixes three security issues with severity “low” in 5.2.13. ASGI requests with a missing or understated Content-Length header could bypass the…","html":"<h1>Django 5.2.14 release notes<a class=\"heading-anchor\" href=\"#django-5-2-14-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>May 5, 2026</em></p>\n<p>Django 5.2.14 fixes three security issues with severity “low” in 5.2.13.</p>\n<section id=\"cve-2026-5766-potential-denial-of-service-vulnerability-in-asgi-requests-via-file-upload-limit-bypass\">\n<h2>CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass<a class=\"heading-anchor\" href=\"#cve-2026-5766-potential-denial-of-service-vulnerability-in-asgi-requests-via-file-upload-limit-bypass\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>ASGI requests with a missing or understated <code class=\"docutils literal notranslate\">Content-Length</code> header could\nbypass the <a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-FILE_UPLOAD_MAX_MEMORY_SIZE\"><code class=\"xref std std-setting docutils literal notranslate\">FILE_UPLOAD_MAX_MEMORY_SIZE</code></a> limit, potentially loading\nlarge files into memory and causing service degradation.</p>\n<p>As a reminder, Django <a class=\"reference internal\" href=\"/en/dev/topics/security/#user-uploaded-content-security\"><span class=\"std std-ref\">expects a limit to be configured</span></a> at the web server level rather than solely\nrelying on <a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-FILE_UPLOAD_MAX_MEMORY_SIZE\"><code class=\"xref std std-setting docutils literal notranslate\">FILE_UPLOAD_MAX_MEMORY_SIZE</code></a>.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>\n<section id=\"cve-2026-35192-session-fixation-via-public-cached-pages-and-session-save-every-request\">\n<h2>CVE-2026-35192: Session fixation via public cached pages and <code class=\"docutils literal notranslate\">SESSION_SAVE_EVERY_REQUEST</code><a class=\"heading-anchor\" href=\"#cve-2026-35192-session-fixation-via-public-cached-pages-and-session-save-every-request\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Response headers did not <a class=\"reference internal\" href=\"/en/dev/topics/cache/#using-vary-headers\"><span class=\"std std-ref\">vary on</span></a> cookies if a\nsession was not modified, but <a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-SESSION_SAVE_EVERY_REQUEST\"><code class=\"xref std std-setting docutils literal notranslate\">SESSION_SAVE_EVERY_REQUEST</code></a> was\n<code class=\"docutils literal notranslate\">True</code>. A remote attacker could steal a user’s session after that user visits\na cached public page.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>\n<section id=\"cve-2026-6907-potential-exposure-of-private-data-due-to-incorrect-handling-of-vary-in-updatecachemiddleware\">\n<h2>CVE-2026-6907: Potential exposure of private data due to incorrect handling of <code class=\"docutils literal notranslate\">Vary: *</code> in <code class=\"docutils literal notranslate\">UpdateCacheMiddleware</code><a class=\"heading-anchor\" href=\"#cve-2026-6907-potential-exposure-of-private-data-due-to-incorrect-handling-of-vary-in-updatecachemiddleware\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Previously, <a class=\"reference internal\" href=\"/en/dev/ref/middleware/#django.middleware.cache.UpdateCacheMiddleware\" title=\"django.middleware.cache.UpdateCacheMiddleware\"><code class=\"xref py py-class docutils literal notranslate\">UpdateCacheMiddleware</code></a> would\nerroneously cache requests where the <code class=\"docutils literal notranslate\">Vary</code> header contained an asterisk\n(<code class=\"docutils literal notranslate\">'*'</code>). This could lead to private data being stored and served.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>","rootId":"django-5-2-14-release-notes","toc":[{"title":"CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass","anchor":"cve-2026-5766-potential-denial-of-service-vulnerability-in-asgi-requests-via-file-upload-limit-bypass","children":[]},{"title":"CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST","anchor":"cve-2026-35192-session-fixation-via-public-cached-pages-and-session-save-every-request","children":[]},{"title":"CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware","anchor":"cve-2026-6907-potential-exposure-of-private-data-due-to-incorrect-handling-of-vary-in-updatecachemiddleware","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/5.2.15","title":"Django 5.2.15 release notes","url":"/en/dev/releases/5.2.15/"},"next":{"docname":"releases/5.2.13","title":"Django 5.2.13 release notes","url":"/en/dev/releases/5.2.13/"},"formats":{"html":"/en/dev/releases/5.2.14/","markdown":"/en/dev/releases/5.2.14.md","json":"/en/dev/releases/5.2.14.json"},"source":"https://github.com/django/django/blob/main/docs/releases/5.2.14.txt","official":"https://docs.djangoproject.com/en/dev/releases/5.2.14/","inVersions":["dev","6.1","6.0","5.2"],"inLocales":["en"]}