Search: CVE-2026-7666

A vulnerability in Django's SMTP email backend allows an on-path attacker to intercept email content in cleartext if a STARTTLS handshake fails and the connection is reused with fail_silently=True. This affects Django versions 6.0 and 5.2. The issue arises because the backend does not prevent reuse of a partially-initialized connection after a failed STARTTLS attempt. The severity is rated low with a CVSS score of 3.1.