CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.core.mail.backends.smtp.EmailBackend in Django fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake when failsilently=True, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 5.2.15-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7666?
The severity of CVE-2026-7666 is rated as low with a score of 3.1.
How do I fix CVE-2026-7666?
To fix CVE-2026-7666, upgrade Django to version 6.0.6 or later, or 5.2.15 or later.
What impact does CVE-2026-7666 have on email security?
CVE-2026-7666 allows on-path attackers to potentially read unencrypted email transmissions due to a failure in the STARTTLS handshake.
Which versions of Django are affected by CVE-2026-7666?
Django versions 6.0 before 6.0.6 and 5.2 before 5.2.15 are affected by CVE-2026-7666.
What is the primary cause of CVE-2026-7666?
The primary cause of CVE-2026-7666 is the reuse of a partially-initialized connection after a failed STARTTLS handshake when fail_silently=True.