{"title":"Django 6.0.5 release notes","version":"dev","locale":"en","docname":"releases/6.0.5","url":"/en/dev/releases/6.0.5/","canonical":"https://djangodocs.dev/en/dev/releases/6.0.5/","summary":"Django 6.0.5 fixes three security issues with severity “low” and several bugs in 6.0.4.","html":"

Django 6.0.5 release notesLink to this heading#

\n

May 5, 2026

\n

Django 6.0.5 fixes three security issues with severity “low” and several bugs\nin 6.0.4.

\n
\n

CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypassLink to this heading#

\n

ASGI requests with a missing or understated Content-Length header could\nbypass the FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading\nlarge files into memory and causing service degradation.

\n

As a reminder, Django expects a limit to be configured at the web server level rather than solely\nrelying on FILE_UPLOAD_MAX_MEMORY_SIZE.

\n

This issue has severity “low” according to the Django security policy.

\n
\n
\n

CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUESTLink to this heading#

\n

Response headers did not vary on cookies if a\nsession was not modified, but SESSION_SAVE_EVERY_REQUEST was\nTrue. A remote attacker could steal a user’s session after that user visits\na cached public page.

\n

This issue has severity “low” according to the Django security policy.

\n
\n
\n

CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddlewareLink to this heading#

\n

Previously, UpdateCacheMiddleware would\nerroneously cache requests where the Vary header contained an asterisk\n('*'). This could lead to private data being stored and served.

\n

This issue has severity “low” according to the Django security policy.

\n
\n
\n

BugfixesLink to this heading#

\n\n
","rootId":"django-6-0-5-release-notes","toc":[{"title":"CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass","anchor":"cve-2026-5766-potential-denial-of-service-vulnerability-in-asgi-requests-via-file-upload-limit-bypass","children":[]},{"title":"CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST","anchor":"cve-2026-35192-session-fixation-via-public-cached-pages-and-session-save-every-request","children":[]},{"title":"CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware","anchor":"cve-2026-6907-potential-exposure-of-private-data-due-to-incorrect-handling-of-vary-in-updatecachemiddleware","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/6.0.6","title":"Django 6.0.6 release notes","url":"/en/dev/releases/6.0.6/"},"next":{"docname":"releases/6.0.4","title":"Django 6.0.4 release notes","url":"/en/dev/releases/6.0.4/"},"formats":{"html":"/en/dev/releases/6.0.5/","markdown":"/en/dev/releases/6.0.5.md","json":"/en/dev/releases/6.0.5.json"},"source":"https://github.com/django/django/blob/main/docs/releases/6.0.5.txt","official":"https://docs.djangoproject.com/en/dev/releases/6.0.5/","inVersions":["dev","6.1","6.0"],"inLocales":["en"]}