Natalia Bidart

Potential exposure of private data via cached Set-Cookie response

Header injection possibility since DomainNameValidator accepted newlines in input

Potential exposure of private data via whitespace padding in Vary header

Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware

Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware

Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie

Potential unencrypted email transmission via STARTTLS in the SMTP backend

Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass

Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

Potential incorrect permissions on newly created file system objects