Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

SUSE python-Django Moderate Security Advisory 2026-1740-1 CVE-2026-33033

suse
Calendar Grey May 7, 2026
Dist Suse Esm H88
Eight vulnerabilities in python-Django for SUSE have been fixed. Ensure updates for moderate threats are applied for safety.
An update that solves eight vulnerabilities can now be installed.

Summary

## This update for python-Django fixes the following issues * CVE-2026-3902: headers spoofing by exploiting an ambiguous mapping of two header variants in `ASGIRequest` requests (bsc#1261729). * CVE-2026-4277: permissions on inline model instances were not validated on submission of forged POST data in GenericInlineModelAdmin (bsc#1261731). * CVE-2026-4292: admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data (bsc#1261732). * CVE-2026-5766: potential denial-of-service vulnerability in ASGI requests via file upload limit bypass (bsc#1264153). * CVE-2026-6907: potential exposure of private data due to incorrect handling of `Vary: *` in `UpdateCacheMiddleware` (bsc#1264152).

Topics%20covered

Topics Covered

security advisory moderate denial of service SuSE threat exposure python-django

References

* bsc#1261722

* bsc#1261724

* bsc#1261729

* bsc#1261731

* bsc#1261732

* bsc#1264152

* bsc#1264153

* bsc#1264154

Cross-

* CVE-2026-33033

* CVE-2026-33034

* CVE-2026-35192

* CVE-2026-3902

* CVE-2026-4277

* CVE-2026-4292

* CVE-2026-5766

* CVE-2026-6907

CVSS scores:

* CVE-2026-33033 ( SUSE ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

* CVE-2026-33033 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2026-33033 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-33034 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2026-33034 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-35192 ( SUSE ): 2.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Announcement ID: SUSE-SU-2026:1740-1
Release Date: 2026-05-07T07:00:33Z
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate denial of service SuSE threat exposure python-django

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here