CVE-2026-7666
LOW
2,3
Source: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW
3,1
Source: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Description
AI Translation Available
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
`django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Kasper Dupont for reporting this issue.
319
Cleartext Transmission of Sensitive Information
DraftCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Potential Impacts:
Read Application Data
Modify Files Or Directories
Other
Applicable Platforms
Technologies:
Not Technology-Specific, Cloud Computing, Mobile, ICS/OT, System on Chip, Test/Debug Hardware
https://docs.djangoproject.com/en/dev/releases/security/
https://groups.google.com/g/django-announce
https://www.djangoproject.com/weblog/2026/jun/03/security-releases/