Django kwetsbaar voor ASGI header spoofing via underscore/hyphen verwarring

The core of this vulnerability lies in Django's handling of HTTP headers. Specifically, the ASGIRequest component incorrectly maps header names that differ only by the presence of hyphens versus underscores to a single, underscore-based header. An attacker can exploit this by sending requests with both header variants, effectively controlling which header is processed by the application. This header spoofing can lead to a variety of consequences, including manipulating application logic, bypassing authentication checks, and potentially gaining unauthorized access to sensitive data. The impact is amplified if the application relies on these headers for critical functionality, such as authorization or input validation. While the description doesn't explicitly mention a specific attack vector, the ability to spoof headers opens the door to a broad range of attacks.

Applications heavily reliant on HTTP headers for authentication, authorization, or input validation are particularly at risk. Django projects using older, unsupported versions (5.0.x, 4.1.x, 3.2.x) are also vulnerable, despite not being formally evaluated. Shared hosting environments where header manipulation could impact multiple applications should prioritize patching.

• python / server:

# Check Django version
python -c "import django; print(django.get_version())"

• generic web:

# Inspect access logs for unusual header patterns (e.g., multiple headers with slight variations)
grep -i 'header_name_with_hyphens|header_name_with_underscores' /var/log/apache2/access.log

1. 2026-04-07Disclosure

   disclosure

1. Gereserveerd2026-03-10
2. Gepubliceerd2026-04-07
3. Gewijzigd2026-04-09
4. EPSS bijgewerkt2026-04-15

The primary mitigation for CVE-2026-3902 is to upgrade to Django version 6.0.4 or later. This version contains a fix that resolves the ambiguous header mapping issue. If upgrading is not immediately feasible, consider implementing a temporary workaround by carefully validating and sanitizing all incoming HTTP headers within your Django application. This can involve explicitly checking for expected header names and formats, and rejecting any requests that deviate from these expectations. Web application firewalls (WAFs) configured to inspect and filter HTTP headers can also provide an additional layer of defense. There are no specific Sigma or YARA rules readily available for this vulnerability, but monitoring for unusual header patterns in your access logs is recommended.