Title: Django de djangoproject, Description: Se descubrió un problema en Django 6.0 anterior a 6.0.6 y 5.2 anterior a 5.2.15.
'django.http.HttpRequest.get_signed_cookie' en Django utiliza una derivación de sal no inyectiva (concatenando el nombre de la cookie y el argumento de sal), lo que permite a un atacante remoto usar una cookie en un contexto diferente de aquel donde fue firmada, a través de pares '(name, salt)' distintos que producen la misma concatenación.
Series de Django anteriores y no compatibles (como 5.0.x, 4.1.x y 3.2.x) no fueron evaluadas y también podrían estar afectadas.
Django desea agradecer a Peng Zhou por informar sobre este problema.

{"timestamp":"2026-06-03T15:43:52.491634Z","id":"CVE-2026-6873","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"djangoproject","product":"Django","defaultStatus":"unaffected","collectionURL":"https://pypi.org/project/Django/","packageName":"django","repo":"https://github.com/django/django/","versions":[{"version":"6.0","lessThan":"6.0.6","versionType":"python","status":"affected"},{"version":"6.0.6","versionType":"python","status":"unaffected"},{"version":"5.2","lessThan":"5.2.15","versionType":"python","status":"affected"},{"version":"5.2.15","versionType":"python","status":"unaffected"}]}]

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OR
          *cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* versions from (including) 5.2 up to (excluding) 5.2.15
          *cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* versions from (including) 6.0 up to (excluding) 6.0.6

Django Software Foundation: https://docs.djangoproject.com/en/dev/releases/security/ Types: Patch, Vendor Advisory

Django Software Foundation: https://groups.google.com/g/django-announce Types: Release Notes

Django Software Foundation: https://www.djangoproject.com/weblog/2026/jun/03/security-releases/ Types: Patch, Vendor Advisory

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
`django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Peng Zhou for reporting this issue.

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-347

https://docs.djangoproject.com/en/dev/releases/security/

https://groups.google.com/g/django-announce

https://www.djangoproject.com/weblog/2026/jun/03/security-releases/