StackRadar

CVE-2026-3902

High

Advisory

Published 7 Apr 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
37th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
28
of 17,781 indexed, latest versions
Container images
29
deployed by those charts
Fix available
1 of 1
affected package

Django vulnerable to ASGI header spoofing via underscore/hyphen conflation

Carried by container images the latest versions of 28 of 17,781 indexed charts deploy, on 29 images.

Affected packageAffected versionsFixed inImages
djangopypi4.2, 4.2.7, 4.2.11, 4.2.15+13 more4.2.30, 5.2.13, 6.0.429
OSV records
GHSA-mvfq-ggxm-9mc5
Also known as
BIT-django-2026-3902, PYSEC-2026-51

Charts affected

28 by stars
ChartLatestAffected imagesRadar Score
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
django@4.2.22
4.2.30

Open the chart page →

16,251
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
django@4.2.23
4.2.30

Open the chart page →

27,267
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
django@4.2.11
4.2.30

Open the chart page →

1,650
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
django@5.2.7
5.2.13

Open the chart page →

12,037
psonoankra-chartsVerified publisher1.2.01 of 2See more

psono ankra-charts 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
psono/psono-server:5.0.03b974b43ea03
django@4.2.16
4.2.30

Open the chart page →

2,388
squestchristianhuthVerified publisher6.6.71 of 4See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
django@4.2.21
4.2.30

Open the chart page →

9,971
seafiledr300481Verified publisher0.12.11 of 1See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
django@4.2.15
4.2.30

Open the chart page →

10,858
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
django@4.2.23
4.2.30

Open the chart page →

12,397
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
django@5.2.3
5.2.13

Open the chart page →

6,873
healthchecksstackhelmVerified publisher0.1.01 of 2See more

healthchecks stackhelm 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
healthchecks/healthchecks:v2.8.1e82bb0836e30
django@4.2
4.2.30

Open the chart page →

2,236
qleverzazukoVerified publisher0.7.01 of 2See more

qlever zazuko 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/zazukoians/qlever-ui:v0.10.034c7b540a095
django@5.2.12
5.2.13

Open the chart page →

2,900
mathesarandrenarchyVerified publisher1.8.01 of 1See more

mathesar andrenarchy 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
mathesar/mathesar:0.12.0091757cb01fe
django@4.2.29
4.2.30

Open the chart page →

7,239
ddosifyanteonVerified publisher1.7.51 of 13See more

ddosify anteon 1.7.5

1 of the 13 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
django@4.2.11
4.2.30

Open the chart page →

25,669
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-web:3.0.06961eab190a2
django@5.2.11
5.2.13

Open the chart page →

15,371
codecovdoubanVerified publisher0.2.42 of 8See more

codecov douban 0.2.4

2 of the 8 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
codecov/self-hosted-api:24.4.10475cb1c3136
django@4.2.7
4.2.30
codecov/self-hosted-worker:24.4.1837f546b479b
django@4.2.11
4.2.30

Open the chart page →

24,917
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
django@4.2.18
4.2.30

Open the chart page →

2,183
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
django@5.2.12
5.2.13

Open the chart page →

10,849
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
django@4.2.7
4.2.30

Open the chart page →

16,384
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
django@4.2.27
4.2.30

Open the chart page →

17,852
ja-shortenerja-shortenerVerified publisher0.1.01 of 2See more

ja-shortener ja-shortener 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
cr0hn/ja-shortener:v0.1.414482d0bc4a1
django@5.2.3
5.2.13

Open the chart page →

2,089
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
django@5.2.7
5.2.13

Open the chart page →

9,103
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
django@5.2.11
5.2.13

Open the chart page →

4,568
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
django@5.2.7
5.2.13

Open the chart page →

11,950
linkdingpascaliskeVerified publisher3.0.01 of 1See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
django@6.0
6.0.4

Open the chart page →

3,854
libretimepodzone-chartsVerified publisher0.4.11 of 9See more

libretime podzone-charts 0.4.1

1 of the 9 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/libretime/libretime-api:latesteae026cc8909
django@4.2.23
4.2.30

Open the chart page →

11,149
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
django@5.2.7
5.2.13

Open the chart page →

10,605
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
django@5.2.8
5.2.13

Open the chart page →

4,499
substra-backendsubstraVerified publisher26.15.31 of 7See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-3902.

Container imageDigestPackageFixed in
ghcr.io/substra/substra-backend:1.0.121967f54ec86
django@4.2.16
4.2.30

Open the chart page →

4,731

Container images carrying it

29 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
django@5.2.12
5.2.13
1
codecov/self-hosted-api:24.4.10475cb1c3136
django@4.2.7
4.2.30
1
codecov/self-hosted-worker:24.4.1837f546b479b
django@4.2.11
4.2.30
1
cr0hn/ja-shortener:v0.1.414482d0bc4a1
django@5.2.3
5.2.13
1
datamate/seafile-professional:11.0.202dd66b722464
django@4.2.23
4.2.30
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
django@4.2.11
4.2.30
1
gethue/hue:latest7d5c1b9f8a79
django@4.2.23
4.2.30
1
grafana/oncall:v1.16.5499851658393
django@4.2.22
4.2.30
1
healthchecks/healthchecks:v2.8.1e82bb0836e30
django@4.2
4.2.30
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
django@4.2.27
4.2.30
1
mathesar/mathesar:0.12.0091757cb01fe
django@4.2.29
4.2.30
1
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
django@4.2.11
4.2.30
1
psono/psono-server:5.0.03b974b43ea03
django@4.2.16
4.2.30
1
seafileltd/seafile-mc:11.0.12d0c66e4621bd
django@4.2.15
4.2.30
1
vabene1111/recipes:2.3.50f8d061895e9
django@5.2.8
5.2.13
1
ghcr.io/cfi2017/opencve-web:3.0.06961eab190a2
django@5.2.11
5.2.13
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
django@5.2.11
5.2.13
1
ghcr.io/libretime/libretime-api:latesteae026cc8909
django@4.2.23
4.2.30
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
django@5.2.7
5.2.13
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
django@5.2.7
5.2.13
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
django@5.2.7
5.2.13
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
django@4.2.7
4.2.30
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
django@5.2.7
5.2.13
1
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
django@6.0
6.0.4
1
ghcr.io/substra/substra-backend:1.0.121967f54ec86
django@4.2.16
4.2.30
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
django@4.2.18
4.2.30
1
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
django@5.2.3
5.2.13
1
ghcr.io/zazukoians/qlever-ui:v0.10.034c7b540a095
django@5.2.12
5.2.13
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
django@4.2.21
4.2.30
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.