{"title":"Django 6.0.6 release notes","version":"dev","locale":"en","docname":"releases/6.0.6","url":"/en/dev/releases/6.0.6/","canonical":"https://djangodocs.dev/en/dev/releases/6.0.6/","summary":"Django 6.0.6 fixes five security issues with severity “low” and one bug in 6.0.5. Also, the latest string translations from Transifex are incorporated.","html":"<h1>Django 6.0.6 release notes<a class=\"heading-anchor\" href=\"#django-6-0-6-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>June 3, 2026</em></p>\n<p>Django 6.0.6 fixes five security issues with severity “low” and one bug in\n6.0.5. Also, the latest string translations from Transifex are incorporated.</p>\n<section id=\"cve-2026-6873-signed-cookie-salt-namespace-collision\">\n<h2>CVE-2026-6873: Signed cookie salt namespace collision<a class=\"heading-anchor\" href=\"#cve-2026-6873-signed-cookie-salt-namespace-collision\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/request-response/#django.http.HttpRequest.get_signed_cookie\" title=\"django.http.HttpRequest.get_signed_cookie\"><code class=\"xref py py-meth docutils literal notranslate\">get_signed_cookie()</code></a> derived the signing salt by\nconcatenating the cookie name (<code class=\"docutils literal notranslate\">key</code>) and <code class=\"docutils literal notranslate\">salt</code> arguments. When distinct\nname and salt pairs produced the same concatenation, cookies could be accepted\nin a context different from the one where they were signed.</p>\n<p>Cookies are now signed with an unambiguous salt derivation. For backwards\ncompatibility, cookies signed by older Django versions are accepted until\nDjango 2028. Projects affected by the above ambiguity should set\n<a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-SIGNED_COOKIE_LEGACY_SALT_FALLBACK\"><code class=\"xref std std-setting docutils literal notranslate\">SIGNED_COOKIE_LEGACY_SALT_FALLBACK</code></a> to <code class=\"docutils literal notranslate\">False</code> to reject older\ncookies immediately.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>\n<section id=\"cve-2026-7666-potential-unencrypted-email-transmission-via-starttls-in-the-smtp-backend\">\n<h2>CVE-2026-7666: Potential unencrypted email transmission via <code class=\"docutils literal notranslate\">STARTTLS</code> in the SMTP backend<a class=\"heading-anchor\" href=\"#cve-2026-7666-potential-unencrypted-email-transmission-via-starttls-in-the-smtp-backend\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>When using <a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-EMAIL_USE_TLS\"><code class=\"xref std std-setting docutils literal notranslate\">EMAIL_USE_TLS</code></a>, a failed <code class=\"docutils literal notranslate\">STARTTLS</code> handshake could\nleave a partially-initialized connection that would subsequently be reused for\nsending email without encryption. This can occur with <code class=\"docutils literal notranslate\">fail_silently=True</code>,\nas used by <a class=\"reference internal\" href=\"/en/dev/topics/email/#django.core.mail.send_mail\" title=\"django.core.mail.send_mail\"><code class=\"xref py py-func docutils literal notranslate\">send_mail()</code></a> and\n<a class=\"reference internal\" href=\"/en/dev/ref/middleware/#django.middleware.common.BrokenLinkEmailsMiddleware\" title=\"django.middleware.common.BrokenLinkEmailsMiddleware\"><code class=\"xref py py-class docutils literal notranslate\">BrokenLinkEmailsMiddleware</code></a>, among others.\nConnections configured with <a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-EMAIL_USE_SSL\"><code class=\"xref std std-setting docutils literal notranslate\">EMAIL_USE_SSL</code></a> are not affected.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>\n<section id=\"cve-2026-8404-potential-exposure-of-private-data-via-case-sensitive-cache-control-directives\">\n<h2>CVE-2026-8404: Potential exposure of private data via case-sensitive <code class=\"docutils literal notranslate\">Cache-Control</code> directives<a class=\"heading-anchor\" href=\"#cve-2026-8404-potential-exposure-of-private-data-via-case-sensitive-cache-control-directives\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/middleware/#django.middleware.cache.UpdateCacheMiddleware\" title=\"django.middleware.cache.UpdateCacheMiddleware\"><code class=\"xref py py-class docutils literal notranslate\">UpdateCacheMiddleware</code></a> and\n<a class=\"reference internal\" href=\"/en/dev/topics/cache/#django.views.decorators.cache.cache_page\" title=\"django.views.decorators.cache.cache_page\"><code class=\"xref py py-func docutils literal notranslate\">cache_page()</code></a> incorrectly cached responses\nmarked with private <code class=\"docutils literal notranslate\">Cache-Control</code> directives when using mixed or uppercase\nvalues (e.g. <code class=\"docutils literal notranslate\">Private</code>).</p>\n<p>The <a class=\"reference internal\" href=\"/en/dev/topics/http/decorators/#django.views.decorators.cache.cache_control\" title=\"django.views.decorators.cache.cache_control\"><code class=\"xref py py-func docutils literal notranslate\">cache_control()</code></a> decorator and\n<a class=\"reference internal\" href=\"/en/dev/ref/utils/#django.utils.cache.patch_cache_control\" title=\"django.utils.cache.patch_cache_control\"><code class=\"xref py py-func docutils literal notranslate\">patch_cache_control()</code></a> function were not affected,\nsince they normalize directives to lowercase. This issue only affects responses\nwhere <code class=\"docutils literal notranslate\">Cache-Control</code> is set manually.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>\n<section id=\"cve-2026-35193-potential-exposure-of-private-data-via-missing-vary-authorization\">\n<h2>CVE-2026-35193: Potential exposure of private data via missing <code class=\"docutils literal notranslate\">Vary: Authorization</code><a class=\"heading-anchor\" href=\"#cve-2026-35193-potential-exposure-of-private-data-via-missing-vary-authorization\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/middleware/#django.middleware.cache.UpdateCacheMiddleware\" title=\"django.middleware.cache.UpdateCacheMiddleware\"><code class=\"xref py py-class docutils literal notranslate\">UpdateCacheMiddleware</code></a> and\n<a class=\"reference internal\" href=\"/en/dev/topics/cache/#django.views.decorators.cache.cache_page\" title=\"django.views.decorators.cache.cache_page\"><code class=\"xref py py-func docutils literal notranslate\">cache_page()</code></a> decorator allowed responses\nto requests bearing an <code class=\"docutils literal notranslate\">Authorization</code> header (and without <code class=\"docutils literal notranslate\">Cache-Control:\npublic</code>) to be cached. To conform with the existing mechanism for constructing\ncache keys, responses to these requests will now <a class=\"reference internal\" href=\"/en/dev/topics/cache/#using-vary-headers\"><span class=\"std std-ref\">vary on</span></a> <code class=\"docutils literal notranslate\">Authorization</code>.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>\n<section id=\"cve-2026-48587-potential-exposure-of-private-data-via-whitespace-padding-in-vary-header\">\n<h2>CVE-2026-48587: Potential exposure of private data via whitespace padding in <code class=\"docutils literal notranslate\">Vary</code> header<a class=\"heading-anchor\" href=\"#cve-2026-48587-potential-exposure-of-private-data-via-whitespace-padding-in-vary-header\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/middleware/#django.middleware.cache.UpdateCacheMiddleware\" title=\"django.middleware.cache.UpdateCacheMiddleware\"><code class=\"xref py py-class docutils literal notranslate\">UpdateCacheMiddleware</code></a> incorrectly cached\nresponses whose <code class=\"docutils literal notranslate\">Vary</code> header values contained leading or trailing\nwhitespace. Because <code class=\"docutils literal notranslate\">has_vary_header()</code> failed to strip that, a <code class=\"docutils literal notranslate\">Vary: *</code>\nheader value with surrounding whitespace was not recognized as containing the\nwildcard, causing it to be stored and potentially served from the cache when it\nshould not have been.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a bug in Django 6.0 where an alert message on an admin changelist with\n<code class=\"docutils literal notranslate\">ModelAdmin.list_editable</code> referred to the “Run” button by its previous\nname (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/37094\">#37094</a>).</p></li>\n</ul>\n</section>","rootId":"django-6-0-6-release-notes","toc":[{"title":"CVE-2026-6873: Signed cookie salt namespace collision","anchor":"cve-2026-6873-signed-cookie-salt-namespace-collision","children":[]},{"title":"CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend","anchor":"cve-2026-7666-potential-unencrypted-email-transmission-via-starttls-in-the-smtp-backend","children":[]},{"title":"CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives","anchor":"cve-2026-8404-potential-exposure-of-private-data-via-case-sensitive-cache-control-directives","children":[]},{"title":"CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization","anchor":"cve-2026-35193-potential-exposure-of-private-data-via-missing-vary-authorization","children":[]},{"title":"CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header","anchor":"cve-2026-48587-potential-exposure-of-private-data-via-whitespace-padding-in-vary-header","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/6.0.7","title":"Django 6.0.7 release notes","url":"/en/dev/releases/6.0.7/"},"next":{"docname":"releases/6.0.5","title":"Django 6.0.5 release notes","url":"/en/dev/releases/6.0.5/"},"formats":{"html":"/en/dev/releases/6.0.6/","markdown":"/en/dev/releases/6.0.6.md","json":"/en/dev/releases/6.0.6.json"},"source":"https://github.com/django/django/blob/main/docs/releases/6.0.6.txt","official":"https://docs.djangoproject.com/en/dev/releases/6.0.6/","inVersions":["dev","6.1","6.0"],"inLocales":["en"]}