Update dependency django to v5 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
django (changelog)	^4.2.5 → ^5.0.0

---

Django is subject to SQL injection through its column aliases

CVE-2025-57833 / GHSA-6w2r-r2m5-xq5w

More information

Details

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-57833
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://medium.com/@​EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898
• https://www.djangoproject.com/weblog/2025/sep/03/security-releases
• https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5
• https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92
• https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243
• https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html
• http://www.openwall.com/lists/oss-security/2025/09/03/3
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-105.yaml
• https://github.com/advisories/GHSA-6w2r-r2m5-xq5w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to partial directory traversal via archives

CVE-2025-59682 / GHSA-q95w-c7qg-hrff

More information

Details

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-59682
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/oct/01/security-releases
• https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
• https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2
• http://www.openwall.com/lists/oss-security/2025/10/01/3
• https://github.com/advisories/GHSA-q95w-c7qg-hrff

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to SQL injection in column aliases

CVE-2025-59681 / GHSA-hpr9-3m2g-3j9p

More information

Details

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-59681
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/oct/01/security-releases
• https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a
• https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
• http://www.openwall.com/lists/oss-security/2025/10/01/3
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-106.yaml
• https://github.com/advisories/GHSA-hpr9-3m2g-3j9p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

CVE-2025-64458 / GHSA-qw25-v68c-qjf3

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64458
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
• https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
• https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
• https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml
• https://github.com/advisories/GHSA-qw25-v68c-qjf3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

CVE-2025-64459 / GHSA-frmv-pr5f-9mcr

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64459
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
• https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
• https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
• https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
• https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html
• https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-108.yaml
• https://github.com/advisories/GHSA-frmv-pr5f-9mcr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django is vulnerable to SQL injection in column aliases

CVE-2025-13372 / GHSA-rqw2-ghq9-44m7

More information

Details

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Stackered for reporting this issue.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-13372
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/dec/02/security-releases
• https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf
• https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0
• https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e
• https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355
• https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-104.yaml
• https://github.com/advisories/GHSA-rqw2-ghq9-44m7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django is vulnerable to DoS via XML serializer text extraction

CVE-2025-64460 / GHSA-vrcr-9hj9-jcg6

More information

Details

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
Algorithmic complexity in django.core.serializers.xml_serializer.getInnerText() allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML Deserializer.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64460
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/dec/02/security-releases
• https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b
• https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5
• https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0
• https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-109.yaml
• https://github.com/advisories/GHSA-vrcr-9hj9-jcg6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has Observable Timing Discrepancy

CVE-2025-13473 / GHSA-2mcm-79hx-8fxw

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

The django.contrib.auth.handlers.modwsgi.check_password() function for authentication via mod_wsgi allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Stackered for reporting this issue.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-13473
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/feb/03/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-42.yaml
• https://github.com/advisories/GHSA-2mcm-79hx-8fxw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has Inefficient Algorithmic Complexity

CVE-2026-1285 / GHSA-4rrr-2h4v-f3j9

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

django.utils.text.Truncator.chars() and Truncator.words() methods (with html=True) and the truncatechars_html and truncatewords_html template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-1285
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/feb/03/security-releases
• https://github.com/django/django/commit/a33540b3e20b5d759aa8b2e4b9ca0e8edd285344
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-45.yaml
• https://github.com/advisories/GHSA-4rrr-2h4v-f3j9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has Inefficient Algorithmic Complexity

CVE-2025-14550 / GHSA-33mw-q7rj-mjwj

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Jiyong Yang for reporting this issue.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-14550
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/feb/03/security-releases
• https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-43.yaml
• https://github.com/advisories/GHSA-33mw-q7rj-mjwj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has an SQL Injection issue

CVE-2026-1207 / GHSA-mwm9-4648-f68q

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Tarek Nakkouch for reporting this issue.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-1207
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/feb/03/security-releases
• https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-44.yaml
• https://github.com/advisories/GHSA-mwm9-4648-f68q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has an SQL Injection issue

CVE-2026-1287 / GHSA-gvg8-93h5-g6qq

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

FilteredRelation is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet methods annotate(), aggregate(), extra(), values(), values_list(), and alias(). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Solomon Kebede for reporting this issue.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-1287
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/feb/03/security-releases
• https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-46.yaml
• https://github.com/advisories/GHSA-gvg8-93h5-g6qq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has an SQL Injection issue

CVE-2026-1312 / GHSA-6426-9fv3-65x8

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

.QuerySet.order_by() is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Solomon Kebede for reporting this issue.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-1312
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/feb/03/security-releases
• https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84
• https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-47.yaml
• https://github.com/advisories/GHSA-6426-9fv3-65x8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to Uncontrolled Resource Consumption

CVE-2026-25673 / GHSA-8p8v-wh79-9r56

More information

Details

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.

URLField.to_python() in Django calls urllib.parse.urlsplit(), which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-25673
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/mar/03/security-releases
• https://github.com/advisories/GHSA-8p8v-wh79-9r56

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has a Race Condition vulnerability

CVE-2026-25674 / GHSA-mjgh-79qc-68w3

More information

Details

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.

Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary umask change affects other threads in multi-threaded environments.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Tarek Nakkouch for reporting this issue.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-25674
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/mar/03/security-releases
• https://github.com/advisories/GHSA-mjgh-79qc-68w3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: SGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit

CVE-2026-33034 / GHSA-933h-hp56-hf7m

More information

Details

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into memory.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Superior for reporting this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33034
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/apr/07/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-49.yaml
• https://github.com/advisories/GHSA-933h-hp56-hf7m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has potential DoS via MultiPartParser through crafted multipart uploads

CVE-2026-33033 / GHSA-5mf9-h53q-7mhq

More information

Details

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with Content-Transfer-Encoding: base64 including excessive whitespace.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33033
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/apr/07/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-48.yaml
• https://github.com/advisories/GHSA-5mf9-h53q-7mhq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to privilege abuse in GenericInlineModelAdmin

CVE-2026-4277 / GHSA-pwjp-ccjc-ghwg

More information

Details

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged POST data in GenericInlineModelAdmin.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank N05ec@LZU-DSLab for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4277
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/apr/07/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-52.yaml
• https://github.com/advisories/GHSA-pwjp-ccjc-ghwg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to privilege abuse in ModelAdmin.list_editable

CVE-2026-4292 / GHSA-mmwr-2jhp-mc7j

More information

Details

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Cantina for reporting this issue.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4292
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/apr/07/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-53.yaml
• https://github.com/advisories/GHSA-mmwr-2jhp-mc7j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to ASGI header spoofing via underscore/hyphen conflation

CVE-2026-3902 / GHSA-mvfq-ggxm-9mc5

More information

Details

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Tarek Nakkouch for reporting this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-3902
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/apr/07/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-51.yaml
• https://github.com/advisories/GHSA-mvfq-ggxm-9mc5

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: has_vary_header may expose cached responses when Vary values contain whitespace

CVE-2026-48587 / GHSA-923m-gv2p-w5qp

More information

Details

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
django.utils.cache.has_vary_header() in Django does not strip leading or trailing whitespace from Vary response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Navid Rezazadeh for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-48587
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases
• https://github.com/django/django/commit/1721035a72624aad7b38dd19b14013efd94b24b8
• https://github.com/django/django/commit/42aa0b3364d312e7c6472258d8b0e9c0277fbf22
• https://github.com/django/django/commit/9b62b0af71a14c657d19d95371630ba839e83d9a
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-198.yaml
• https://github.com/advisories/GHSA-923m-gv2p-w5qp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: GDALRaster may over-read heap memory when constructed from bytes

CVE-2026-53877 / GHSA-crhf-3pfg-w68w

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
django.contrib.gis.gdal.GDALRaster over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the vsi_buffer property is accessed.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53877
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/38dfbd27d7d4f4e6eaa087d7a90f2613fbf55b3a
• https://github.com/django/django/commit/6c66eb8cec52b303af85c2c6e4dd00aa37654dbc
• https://github.com/django/django/commit/6ca2bbe2efce21010eff48f1f36a3f621d698ed8
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2091.yaml
• https://github.com/advisories/GHSA-crhf-3pfg-w68w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: cache middleware may expose private responses when unrelated request cookies are present

CVE-2026-48588 / GHSA-3h9f-r86x-qvjx

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
UpdateCacheMiddleware and the cache_page() decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Chris Whyland for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-48588
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3
• https://github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1
• https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yaml
• https://github.com/advisories/GHSA-3h9f-r86x-qvjx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

CVE-2026-8404 / GHSA-8cjm-8mp7-r2xf

More information

Details

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their Cache-Control directives used uppercase or mixed-case values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Ahmed Badawe for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-8404
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases
• https://github.com/django/django/commit/366d9ae6e8d1469c04e9ebdc1bcd098fc14a3b1e
• https://github.com/django/django/commit/b4330259ffbe1a031ed14daab1f35697460f10f2
• https://github.com/django/django/commit/d618d7ae4fec727d5b582bd24f803c28d17bf7cd
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-201.yaml
• https://github.com/advisories/GHSA-8cjm-8mp7-r2xf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

CVE-2026-53878 / GHSA-8qcx-xf44-272x

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
DomainNameValidator does not prohibit newlines in domain names (unless used via a form field, since CharField strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53878
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/3a720d0d8bf2529253b98968f10ca73daf6d693c
• https://github.com/django/django/commit/a5de13f1491f1dbf2bb0ad9b91570524ebbc8acd
• https://github.com/django/django/commit/d5d60ed0323cddaa0ce0237a26a3d49ac21ee05e
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2092.yaml
• https://github.com/advisories/GHSA-8qcx-xf44-272x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: signed cookies are vulnerable to salt namespace collisions

CVE-2026-6873 / GHSA-h7pc-vwp9-298g

More information

Details

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
django.http.HttpRequest.get_signed_cookie in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct (name, salt) pairs that produce the same concatenation.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Peng Zhou for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-6873
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases
• https://github.com/django/django/commit/594360cbf58be7f56eb6da96d58644297c99ef85
• https://github.com/django/django/commit/70d36515b9cc71700105a14b275583070d48b689
• https://github.com/django/django/commit/c807d9c398022d23cb27518fa6ecaf343efb30cf
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-199.yaml
• https://github.com/advisories/GHSA-h7pc-vwp9-298g

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/adv

✂ Note

PR body was truncated to here.