Title: Django de djangoproject, Description: Se descubrió un problema en Django 6.0 anterior a 6.0.6 y 5.2 anterior a 5.2.15.
'django.core.mail.backends.smtp.EmailBackend' en Django falla al evitar la reutilización de una conexión parcialmente inicializada después de un handshake 'STARTTLS' fallido cuando 'fail_silently=True', lo que permite a atacantes de red en la ruta leer el contenido del correo electrónico mediante intercepción de texto claro.
Series de Django anteriores no soportadas (como 5.0.x, 4.1.x y 3.2.x) no fueron evaluadas y también podrían estar afectadas.
Django desea agradecer a Kasper Dupont por reportar este problema.

{"timestamp":"2026-06-03T15:43:26.714914Z","id":"CVE-2026-7666","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"djangoproject","product":"Django","defaultStatus":"unaffected","collectionURL":"https://pypi.org/project/Django/","packageName":"django","repo":"https://github.com/django/django/","versions":[{"version":"6.0","lessThan":"6.0.6","versionType":"python","status":"affected"},{"version":"6.0.6","versionType":"python","status":"unaffected"},{"version":"5.2","lessThan":"5.2.15","versionType":"python","status":"affected"},{"version":"5.2.15","versionType":"python","status":"unaffected"}]}]

OR
          *cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* versions from (including) 5.2 up to (excluding) 5.2.15
          *cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* versions from (including) 6.0 up to (excluding) 6.0.6

Django Software Foundation: https://docs.djangoproject.com/en/dev/releases/security/ Types: Patch, Vendor Advisory

Django Software Foundation: https://groups.google.com/g/django-announce Types: Release Notes

Django Software Foundation: https://www.djangoproject.com/weblog/2026/jun/03/security-releases/ Types: Patch, Vendor Advisory

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
`django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Kasper Dupont for reporting this issue.

AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-319

https://docs.djangoproject.com/en/dev/releases/security/

https://groups.google.com/g/django-announce

https://www.djangoproject.com/weblog/2026/jun/03/security-releases/