Is CVE-2026-3902 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3902 being exploited in the wild.

How severe is CVE-2026-3902?

High severity, with a CVSS score of 7.5, published 7 April 2026.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=4.2,fixed=4.2.30,introduced=5.2,fixed=5.2.13,introduced=6.0,fixed=6.0.4, ECOSYSTEM:introduced=6.0,fixed=6.0.4.

Is there a fix for CVE-2026-3902?

Yes. Django (PyPI): upgrade to 6.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3902 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3902?

Check whether you run Djangoproject Django or Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3902: Django ASGI header spoofing via underscore/hyphen conflation

CVE-2026-3902 · Severity: high · CVSS 7.5 · Published 2026-04-07

A vulnerability in the Django web framework could allow remote attackers to bypass security checks by spoofing web request headers. This occurs because the system incorrectly treats hyphens and underscores as identical when processing certain types of web requests (ASGI). An attacker could use this to impersonate other users or bypass authentication mechanisms, potentially leading to unauthorized access to sensitive data or administrative functions.

Technologies: Djangoproject Django, Django (PyPI). Vendors: Djangoproject, PyPI.

Quick answers

Is CVE-2026-3902 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3902 being exploited in the wild.
How severe is CVE-2026-3902?: High severity, with a CVSS score of 7.5, published 7 April 2026.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=4.2,fixed=4.2.30,introduced=5.2,fixed=5.2.13,introduced=6.0,fixed=6.0.4, ECOSYSTEM:introduced=6.0,fixed=6.0.4.
Is there a fix for CVE-2026-3902?: Yes. Django (PyPI): upgrade to 6.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3902 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3902?: Check whether you run Djangoproject Django or Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 6.0.4 or later
```
pip install "Django>=6.0.4"
```

Technical details

A vulnerability exists in Django's ASGIRequest class where it incorrectly maps HTTP headers containing hyphens and underscores to the same internal representation. Specifically, the mapping process conflates these two characters, allowing a remote attacker to provide a malicious header that is interpreted as a different, security-critical header. This is classified as CWE-290 (Authentication Bypass by Spoofing). The attack can be carried out over the network without authentication or user interaction. Patches are available in versions 6.0.4, 5.2.13, and 4.2.30.

Affected products

Django Software Foundation Django >= 6.0, < 6.0.4
Django Software Foundation Django >= 5.2, < 5.2.13
Django Software Foundation Django >= 4.2, < 4.2.30

Identifiers

CVE-2026-3902
GHSA-mvfq-ggxm-9mc5
PYSEC-2026-51

Timeline

2026-04-07: disclosed
2026-04-07: advisory
2026-04-07: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.