Potential unencrypted email transmission via STARTTLS in the SMTP backend
Summary
| CVE | CVE-2026-7666 |
|---|---|
| State | PUBLISHED |
| Assigner | DSF |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-03 14:16:47 UTC |
| Updated | 2026-06-04 15:21:14 UTC |
| Description | An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue. |
Risk And Classification
Primary CVSS: v4.0 2.3 LOW from 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-319 | CWE-319 CWE-319: Cleartext Transmission of Sensitive Information
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | Secondary | 2.3 | LOW | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 2.3 | LOW | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| 3.1 | 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | Secondary | 3.1 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N |
| 3.1 | CNA | DECLARED | 3.1 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
HighAttack Requirements
PresentPrivileges Required
NoneUser Interaction
PassiveConfidentiality
LowIntegrity
NoneAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
LowIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Djangoproject | Django | affected 6.0 6.0.6 python | Not specified |
| CNA | Djangoproject | Django | unaffected 6.0.6 python | Not specified |
| CNA | Djangoproject | Django | affected 5.2 5.2.15 python | Not specified |
| CNA | Djangoproject | Django | unaffected 5.2.15 python | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.djangoproject.com/weblog/2026/jun/03/security-releases | 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | www.djangoproject.com | |
| groups.google.com/g/django-announce | 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | groups.google.com | |
| docs.djangoproject.com/en/dev/releases/security | 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | docs.djangoproject.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Kasper Dupont (en)
CNA: Jake Howard (en)
CNA: Natalia Bidart (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-04-22T00:00:00.000Z | Initial report received. |
| CNA | 2026-05-12T00:00:00.000Z | Vulnerability confirmed. |
| CNA | 2026-06-03T08:00:00.000Z | Security release issued. |
There are currently no legacy QID mappings associated with this CVE.