CVE-2026-7666
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In Django (versions 6.0 before 6.0.6 and 5.2 before 5.2.15), `EmailBackend` fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake when `fail_silently=True`. This allows on-path network attackers to read email content in cleartext.
Risk Assessment
An on-path attacker can intercept sensitive email content, compromising communication confidentiality.
Recommendation
Update Django to version 6.0.6, 5.2.15, or later.
Original NVD description (English source)
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.