chore(deps): update dependency django to v5 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
Django (changelog)	==3.2.11 → ==5.2.16

---

SQL Injection in Django

CVE-2022-28346 / GHSA-2gwj-7jmv-h26r

More information

Details

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-28346
• https://groups.google.com/forum/#!forum/django-announce
• http://www.openwall.com/lists/oss-security/2022/04/11/1
• https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html
• https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200
• https://github.com/advisories/GHSA-2gwj-7jmv-h26r
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-190.yaml
• https://www.debian.org/security/2022/dsa-5254
• https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48
• https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d
• https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://security.netapp.com/advisory/ntap-20220609-0002
• https://www.djangoproject.com/weblog/2022/apr/11/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

SQL Injection in Django

CVE-2022-28347 / GHSA-w24h-v9qh-8gxj

More information

Details

A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-28347
• https://groups.google.com/forum/#!forum/django-announce
• http://www.openwall.com/lists/oss-security/2022/04/11/1
• https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81
• https://github.com/advisories/GHSA-w24h-v9qh-8gxj
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-191.yaml
• https://www.debian.org/security/2022/dsa-5254
• https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402
• https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5
• https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://www.djangoproject.com/weblog/2022/apr/11/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django denial-of-service vulnerability in internationalized URLs

CVE-2022-41323 / GHSA-qrw5-5h28-6cmg

More information

Details

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-41323
• https://github.com/django/django/commit/5b6b257fa7ec37ff27965358800c67e2dd11c924
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-304.yaml
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/23f0093125ac2e553da6c1b2f9988eb6a3dd2ea1
• https://github.com/django/django/commit/9d656ea51d9ea7105c0c0785783ac29d426a7d25
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP
• https://security.netapp.com/advisory/ntap-20221124-0001
• https://www.djangoproject.com/weblog/2022/oct/04/security-releases
• https://github.com/advisories/GHSA-qrw5-5h28-6cmg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django contains Uncontrolled Resource Consumption via cached header

CVE-2023-23969 / GHSA-q2jf-h9jm-m7p4

More information

Details

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-23969
• https://lists.debian.org/debian-lts-announce/2023/02/msg00000.html
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/4452642f193533e288a52c02efb5bbc766a68f95
• https://github.com/django/django/commit/9d7bd5a56b1ce0576e8e07a8001373576d277942
• https://github.com/django/django/commit/c7e0151fdf33e1b11d488b6f67b94fdf3a30614a
• https://docs.djangoproject.com/en/4.1/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://security.netapp.com/advisory/ntap-20230302-0007
• https://www.djangoproject.com/weblog/2023/feb/01/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-12.yaml
• https://github.com/advisories/GHSA-q2jf-h9jm-m7p4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Denial of service vulnerability in django.utils.encoding.uri_to_iri

CVE-2023-41164 / GHSA-7h4p-27mh-hmrw

More information

Details

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-41164
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/6f030b1149bd8fa4ba90452e77cb3edc095ce54e
• https://github.com/django/django/commit/9c51b4dcfa0cefcb48231f4d71cafa80821f87b9
• https://github.com/django/django/commit/ba00bc5ec6a7eff5e08be438f7b5b0e9574e8ff0
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-225.yaml
• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/4.2/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU
• https://security.netapp.com/advisory/ntap-20231214-0002
• https://www.djangoproject.com/weblog/2023/sep/04/security-releases
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://github.com/advisories/GHSA-7h4p-27mh-hmrw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Regular expression denial-of-service in Django

CVE-2024-27351 / GHSA-vm8q-m57g-pff3

More information

Details

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-27351
• https://docs.djangoproject.com/en/5.0/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/mar/04/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-47.yaml
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• http://www.openwall.com/lists/oss-security/2024/03/04/1
• https://github.com/django/django/commit/072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521
• https://github.com/django/django/commit/3394fc6132436eca89e997083bae9985fb7e761e
• https://github.com/django/django/commit/3c9a2771cc80821e041b16eb36c1c37af5349d4a
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6
• https://github.com/advisories/GHSA-vm8q-m57g-pff3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Cross-site Scripting in Django

CVE-2022-22818 / GHSA-95rw-fx8r-36v6

More information

Details

The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-22818
• https://groups.google.com/forum/#!forum/django-announce
• https://www.debian.org/security/2022/dsa-5254
• https://github.com/django/django/commit/01422046065d2b51f8f613409cad2c81b39487e5
• https://github.com/django/django/commit/1a1e8278c46418bde24c86a65443b0674bae65e2
• https://github.com/django/django/commit/c27a7eb9f40b64990398978152e62b6ff839c2e6
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
• https://security.netapp.com/advisory/ntap-20220221-0003
• https://www.djangoproject.com/weblog/2022/feb/01/security-releases
• https://github.com/advisories/GHSA-95rw-fx8r-36v6
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-19.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Infinite Loop in Django

CVE-2022-23833 / GHSA-6cw3-g6wv-c2xv

More information

Details

An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-23833
• https://groups.google.com/forum/#!forum/django-announce
• https://www.debian.org/security/2022/dsa-5254
• https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a
• https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
• https://security.netapp.com/advisory/ntap-20220221-0003
• https://www.djangoproject.com/weblog/2022/feb/01/security-releases
• https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9
• https://github.com/advisories/GHSA-6cw3-g6wv-c2xv
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-20.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to Reflected File Download attack

CVE-2022-36359 / GHSA-8x94-hmjh-97hq

More information

Details

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-36359
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml
• https://groups.google.com/g/django-announce/c/8cz--gvaJr4
• http://www.openwall.com/lists/oss-security/2022/08/03/1
• https://www.debian.org/security/2022/dsa-5254
• https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b80
• https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb3
• https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://security.netapp.com/advisory/ntap-20220915-0008
• https://www.djangoproject.com/weblog/2022/aug/03/security-releases
• https://github.com/advisories/GHSA-8x94-hmjh-97hq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django denial-of-service attack in the intcomma template filter

CVE-2024-24680 / GHSA-xxj9-f6rv-m3x4

More information

Details

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-24680
• https://groups.google.com/forum/#%21forum/django-announce
• https://github.com/django/django/commit/16a8fe18a3b81250f4fa57e3f93f0599dc4895bc
• https://github.com/django/django/commit/55519d6cf8998fe4c8f5c8abffc2b10a7c3d14e9
• https://github.com/django/django/commit/572ea07e84b38ea8de0551f4b4eda685d91d09d2
• https://github.com/django/django/commit/c1171ffbd570db90ca206c30f8e2b9f691243820
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-28.yaml
• https://docs.djangoproject.com/en/5.0/releases/security
• https://www.djangoproject.com/weblog/2024/feb/06/security-releases
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6
• https://github.com/advisories/GHSA-xxj9-f6rv-m3x4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Resource exhaustion in Django

CVE-2023-24580 / GHSA-2hrw-hx67-34x6

More information

Details

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-24580
• https://groups.google.com/forum/#!forum/django-announce
• http://www.openwall.com/lists/oss-security/2023/02/14/1
• https://github.com/django/django/commit/628b33a854a9c68ec8a0c51f382f304a0044ec92
• https://github.com/django/django/commit/83f1ea83e4553e211c1c5a0dfc197b66d4e50432
• https://github.com/django/django/commit/a665ed5179f5bbd3db95ce67286d0192eff041d8
• https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html
• https://docs.djangoproject.com/en/4.1/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP
• https://security.netapp.com/advisory/ntap-20230316-0006
• https://www.djangoproject.com/weblog/2023/feb/14/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-13.yaml
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B
• https://groups.google.com/forum/#%21forum/django-announce
• https://github.com/advisories/GHSA-2hrw-hx67-34x6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Denial-of-service in django.utils.text.Truncator

CVE-2023-43665 / GHSA-h8gc-pgj2-vjm3

More information

Details

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-43665
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/be9c27c4d18c2e6a5be8af4e53c0797440794473
• https://github.com/django/django/commit/c7b7024742250414e426ad49fb80db943e7ba4e8
• https://github.com/django/django/commit/ccdade1a0262537868d7ca64374de3d957ca50c5
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-226.yaml
• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/4.2/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU
• https://security.netapp.com/advisory/ntap-20231221-0001
• https://www.djangoproject.com/weblog/2023/oct/04/security-releases
• http://www.openwall.com/lists/oss-security/2024/03/04/1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://github.com/advisories/GHSA-h8gc-pgj2-vjm3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django bypasses validation when using one form field to upload multiple files

CVE-2023-31047 / GHSA-r3xc-prgr-mg9p

More information

Details

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-31047
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/21b1b1fc03e5f9e9f8c977ee6e35618dd3b353dd
• https://github.com/django/django/commit/e7c3a2ccc3a562328600be05068ed9149e12ce64
• https://github.com/django/django/commit/eed53d0011622e70b936e203005f0e6f4ac48965
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-61.yaml
• https://docs.djangoproject.com/en/4.2/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD
• https://security.netapp.com/advisory/ntap-20230609-0008
• https://www.djangoproject.com/weblog/2023/may/03/security-releases
• https://github.com/advisories/GHSA-r3xc-prgr-mg9p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has regular expression denial of service vulnerability in EmailValidator/URLValidator

CVE-2023-36053 / GHSA-jh3w-4vvf-mjgr

More information

Details

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-36053
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/454f2fb93437f98917283336201b4048293f7582
• https://github.com/django/django/commit/ad0410ec4f458aa39803e5f6b9a3736527062dcd
• https://github.com/django/django/commit/b7c5feb35a31799de6e582ad6a5a91a9de74e0f9
• https://github.com/django/django/commit/beb3f3d55940d9aa7198bf9d424ab74e873aec3d
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-100.yaml
• https://lists.debian.org/debian-lts-announce/2023/07/msg00022.html
• https://www.debian.org/security/2023/dsa-5465
• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/4.2/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS
• https://www.djangoproject.com/weblog/2023/jul/03/security-releases
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://github.com/advisories/GHSA-jh3w-4vvf-mjgr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Trunc() and Extract() database functions vulnerable to SQL Injection

CVE-2022-34265 / GHSA-p64x-8rxx-wf6q

More information

Details

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-34265
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-213.yaml
• https://github.com/django/django/commit/5e2f4ddf2940704a26a4ac782b851989668d74db
• https://github.com/django/django/commit/877c800f255ccaa7abde1fb944de45d1616f5cc9
• https://github.com/advisories/GHSA-p64x-8rxx-wf6q
• https://www.debian.org/security/2022/dsa-5254
• https://github.com/django/django/commit/0dc9c016fadb71a067e5a42be30164e3f96c0492
• https://github.com/django/django/commit/a9010fe5555e6086a9d9ae50069579400ef0685e
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://security.netapp.com/advisory/ntap-20220818-0006
• https://www.djangoproject.com/weblog/2022/jul/04/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django potential denial of service vulnerability in UsernameField on Windows

CVE-2023-46695 / GHSA-qmf9-6jqf-j8fq

More information

Details

An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-46695
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/048a9ebb6ea468426cb4e57c71572cbbd975517f
• https://github.com/django/django/commit/4965bfdde2e5a5c883685019e57d123a3368a75e
• https://github.com/django/django/commit/f9a7fb8466a7ba4857eaf930099b5258f3eafb2b
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-222.yaml
• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/4.2/releases/security
• https://security.netapp.com/advisory/ntap-20231214-0001
• https://www.djangoproject.com/weblog/2023/nov/01/security-releases
• https://github.com/advisories/GHSA-qmf9-6jqf-j8fq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django allows enumeration of user e-mail addresses

CVE-2024-45231 / GHSA-rrqc-c2jx-6jgv

More information

Details

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-45231
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/sep/03/security-releases
• https://github.com/django/django/commit/3c733c78d6f8e50296d6e248968b6516c92a53ca
• https://github.com/django/django/commit/96d84047715ea1715b4bd1594e46122b8a77b9e2
• https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199
• https://github.com/advisories/GHSA-rrqc-c2jx-6jgv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Improper Output Neutralization for Logs vulnerability

CVE-2025-48432 / GHSA-7xr5-9hcq-chf9

More information

Details

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-48432
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• [https://www.djangoproject.com/weblog/2025/jun/04/security-releases](htt

✂ Note

PR body was truncated to here.