CVE-2018-6596: Debian Linux

Critical severity, CVSS 9.1. EPSS: 2.6% chance of exploitation in the next 30 days.

webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.

Affected products

• Debian Debian Linux: version 9.0 only
• Django-Anymail Project Django-Anymail: before 1.2.1 (fixed in 1.2.1)

Published 2018-02-03. Last modified 2026-06-17.