... low" in 4.2.29. CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations wh ... efault configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the reference server for ASGI. This issue has severity "low" according to the Django s ... severity "moderate" according to the Django security policy . CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass ¶ ASGI requests with a missing or understated Content-Length header could bypass the DATA ... ... low" in 5.2.12. CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations wh ... efault configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the reference server for ASGI. This issue has severity "low" according to the Django s ... severity "moderate" according to the Django security policy . CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass ¶ ASGI requests with a missing or understated Content-Length header could bypass the DATA ... ... low" in 4.2.29. CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations wh ... efault configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the reference server for ASGI. This issue has severity "low" according to the Django s ... severity "moderate" according to the Django security policy . CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass ¶ ASGI requests with a missing or understated Content-Length header could bypass the DATA ... ... low" in 5.2.12. CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations wh ... efault configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the reference server for ASGI. This issue has severity "low" according to the Django s ... severity "moderate" according to the Django security policy . CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass ¶ ASGI requests with a missing or understated Content-Length header could bypass the DATA ... ... tring translations from Transifex are incorporated. CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations wh ... efault configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the reference server for ASGI. This issue has severity "low" according to the Django s ... severity "moderate" according to the Django security policy . CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass ¶ ASGI requests with a missing or understated Content-Length header could bypass the DATA ... ... tring translations from Transifex are incorporated. CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations wh ... efault configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the reference server for ASGI. This issue has severity "low" according to the Django s ... severity "moderate" according to the Django security policy . CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass ¶ ASGI requests with a missing or understated Content-Length header could bypass the DATA ... ... ntial denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker to cause a potential denial-of-service via a specifically created request with multiple duplicat ... ... ntial denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker to cause a potential denial-of-service via a specifically created request with multiple duplicat ... ... ntial denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker to cause a potential denial-of-service via a specifically created request with multiple duplicat ... ... ntial denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker to cause a potential denial-of-service via a specifically created request with multiple duplicat ... 2026年10月08日