security: Multiple CVEs - Django 4.2.16 - Upgrade to 4.2.30 required (incl. CRITICAL SQL injection)

[vks-archastro]

Summary

Django==4.2.16 in apiserver/requirements/base.txt has 14 known CVEs, including 1 Critical and 6 High severity issues. The fix is a patch-level bump to Django==4.2.30 (same LTS series, no breaking changes expected).

---

Vulnerabilities

CVE	Severity	Fixed In	Description
CVE-2025-64459	CRITICAL	4.2.26	SQL injection via _connector kwarg in QuerySet.filter(), .exclude(), .get(), and Q() when dictionary expansion is used — unauthenticated, direct injection
CVE-2026-1287	HIGH	4.2.28	SQL injection in FilteredRelation column aliases via control characters with dict expansion in QuerySet.annotate() etc.
CVE-2026-3902	HIGH	4.2.30	ASGI header spoofing — hyphen/underscore conflation allows request forgery
CVE-2026-33034	HIGH	4.2.30	ASGI Content-Length bypass — unbounded memory load via malformed requests
CVE-2026-25673	HIGH	4.2.29	DoS via URLField.to_python() with Unicode characters
CVE-2025-57833	HIGH	4.2.24	SQL injection in FilteredRelation column aliases
CVE-2025-59681	HIGH	4.2.25	SQL injection in column aliases via ORM methods on MySQL/MariaDB
CVE-2026-1312	MODERATE	4.2.28	SQL injection in QuerySet.order_by() via FilteredRelation
CVE-2026-33033	MODERATE	4.2.30	DoS via MultiPartParser with base64 Content-Transfer-Encoding
CVE-2026-4292	LOW	4.2.30	Admin list_editable allows forged POST to create new instances
CVE-2026-4277	LOW	4.2.30	Missing add permission validation in GenericInlineModelAdmin
Several low/medium DoS	LOW-MODERATE	Various	strip_tags(), wrap(), IPv6 validation, XML serializer, redirect DoS

---

Package Details

• Package: Django
• Current version: 4.2.16
• Fixed version: 4.2.30 (same LTS series, patch upgrade only)
• File: apiserver/requirements/base.txt

---

Triage Reasoning

Escalating rather than auto-fixing because:

1. Requires regression testing after version bump — no visible test suite in scope
2. The SQL injection CVEs (especially CVE-2025-64459) need a manual code audit of ORM call sites using dictionary expansion patterns
3. Human sign-off appropriate given critical severity and auth/DB impact

The Django 4.2 LTS branch is still maintained. This is strictly a patch bump (4.2.16 → 4.2.30) — no migration or API changes expected.

---

Recommended Action

1. In apiserver/requirements/base.txt, change Django==4.2.16 → Django==4.2.30
2. Run the test suite
3. Audit ORM calls using dictionary expansion: QuerySet.filter(**kwargs), QuerySet.annotate(**kwargs), FilteredRelation usages
4. Deploy staging before production

---

Mitigations In Place

• Django ORM parameterizes standard queries — SQL injection requires specific FilteredRelation/dictionary-expansion patterns
• No mitigations reduce the ASGI memory exhaustion risk (CVE-2026-33034)