jonathan/min.ie
jonathan/min.ie
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Update dependency django to v5.2.13 [SECURITY] #6

Merged
jonathan merged 1 commit from renovate/pypi-django-vulnerability into main 2026-04-12 21:17:04 +00:00
Conversation 0 Commits 1 Files changed 1 +168 -168
renovatebot commented 2026-04-12 21:02:25 +00:00
Collaborator
Copy link

This PR contains the following updates:

Package Type Update Change
django (changelog) project.dependencies patch 5.2.7 → 5.2.13

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

BIT-django-2025-64459 / CVE-2025-64459 / GHSA-frmv-pr5f-9mcr

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.

Severity

  • CVSS Score: 9.1 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

BIT-django-2025-64458 / CVE-2025-64458 / GHSA-qw25-v68c-qjf3

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django is vulnerable to SQL injection in column aliases

BIT-django-2025-13372 / CVE-2025-13372 / GHSA-rqw2-ghq9-44m7

More information

Details

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Stackered for reporting this issue.

Severity

  • CVSS Score: 4.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django is vulnerable to DoS via XML serializer text extraction

BIT-django-2025-64460 / CVE-2025-64460 / GHSA-vrcr-9hj9-jcg6

More information

Details

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
Algorithmic complexity in django.core.serializers.xml_serializer.getInnerText() allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML Deserializer.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django has Observable Timing Discrepancy

BIT-django-2025-13473 / CVE-2025-13473 / GHSA-2mcm-79hx-8fxw

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

The django.contrib.auth.handlers.modwsgi.check_password() function for authentication via mod_wsgi allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Stackered for reporting this issue.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django has Inefficient Algorithmic Complexity

BIT-django-2025-14550 / CVE-2025-14550 / GHSA-33mw-q7rj-mjwj

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Jiyong Yang for reporting this issue.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django has Inefficient Algorithmic Complexity

BIT-django-2026-1285 / CVE-2026-1285 / GHSA-4rrr-2h4v-f3j9

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

django.utils.text.Truncator.chars() and Truncator.words() methods (with html=True) and the truncatechars_html and truncatewords_html template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Seokchan Yoon for reporting this issue.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django has an SQL Injection issue

BIT-django-2026-1312 / CVE-2026-1312 / GHSA-6426-9fv3-65x8

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

.QuerySet.order_by() is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Solomon Kebede for reporting this issue.

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django has an SQL Injection issue

BIT-django-2026-1287 / CVE-2026-1287 / GHSA-gvg8-93h5-g6qq

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

FilteredRelation is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet methods annotate(), aggregate(), extra(), values(), values_list(), and alias(). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Solomon Kebede for reporting this issue.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django has an SQL Injection issue

BIT-django-2026-1207 / CVE-2026-1207 / GHSA-mwm9-4648-f68q

More information

Details

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Tarek Nakkouch for reporting this issue.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django vulnerable to Uncontrolled Resource Consumption

BIT-django-2026-25673 / CVE-2026-25673 / GHSA-8p8v-wh79-9r56

More information

Details

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.

URLField.to_python() in Django calls urllib.parse.urlsplit(), which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django has a Race Condition vulnerability

BIT-django-2026-25674 / CVE-2026-25674 / GHSA-mjgh-79qc-68w3

More information

Details

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.

Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary umask change affects other threads in multi-threaded environments.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Tarek Nakkouch for reporting this issue.

Severity

  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django has potential DoS via MultiPartParser through crafted multipart uploads

CVE-2026-33033 / GHSA-5mf9-h53q-7mhq

More information

Details

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with Content-Transfer-Encoding: base64 including excessive whitespace.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django: SGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit

CVE-2026-33034 / GHSA-933h-hp56-hf7m

More information

Details

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into memory.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Superior for reporting this issue.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django vulnerable to privilege abuse in ModelAdmin.list_editable

CVE-2026-4292 / GHSA-mmwr-2jhp-mc7j

More information

Details

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Cantina for reporting this issue.

Severity

  • CVSS Score: 2.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django vulnerable to ASGI header spoofing via underscore/hyphen conflation

CVE-2026-3902 / GHSA-mvfq-ggxm-9mc5

More information

Details

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Tarek Nakkouch for reporting this issue.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Django vulnerable to privilege abuse in GenericInlineModelAdmin

CVE-2026-4277 / GHSA-pwjp-ccjc-ghwg

More information

Details

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged POST data in GenericInlineModelAdmin.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank N05ec@LZU-DSLab for reporting this issue.

Severity

  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

django/django (django)

v5.2.13

Compare Source

v5.2.12

Compare Source

v5.2.11

Compare Source

v5.2.10

Compare Source

v5.2.9

Compare Source

v5.2.8

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [django](https://github.com/django/django) ([changelog](https://docs.djangoproject.com/en/stable/releases/)) | project.dependencies | patch | `5.2.7` → `5.2.13` | --- ### Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects. BIT-django-2025-64459 / [CVE-2025-64459](https://nvd.nist.gov/vuln/detail/CVE-2025-64459) / [GHSA-frmv-pr5f-9mcr](https://github.com/advisories/GHSA-frmv-pr5f-9mcr) <details> <summary>More information</summary> #### Details An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue. #### Severity - CVSS Score: 9.1 / 10 (Critical) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2025-64459](https://nvd.nist.gov/vuln/detail/CVE-2025-64459) - [https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85](https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85) - [https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4](https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4) - [https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b](https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b) - [https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241](https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed](https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html](https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html) - [https://www.djangoproject.com/weblog/2025/nov/05/security-releases](https://www.djangoproject.com/weblog/2025/nov/05/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-frmv-pr5f-9mcr) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows BIT-django-2025-64458 / [CVE-2025-64458](https://nvd.nist.gov/vuln/detail/CVE-2025-64458) / [GHSA-qw25-v68c-qjf3](https://github.com/advisories/GHSA-qw25-v68c-qjf3) <details> <summary>More information</summary> #### Details An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2025-64458](https://nvd.nist.gov/vuln/detail/CVE-2025-64458) - [https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242](https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242) - [https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac](https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac) - [https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f](https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f) - [https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7](https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2025/nov/05/security-releases](https://www.djangoproject.com/weblog/2025/nov/05/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-qw25-v68c-qjf3) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django is vulnerable to SQL injection in column aliases BIT-django-2025-13372 / [CVE-2025-13372](https://nvd.nist.gov/vuln/detail/CVE-2025-13372) / [GHSA-rqw2-ghq9-44m7](https://github.com/advisories/GHSA-rqw2-ghq9-44m7) <details> <summary>More information</summary> #### Details An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue. #### Severity - CVSS Score: 4.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2025-13372](https://nvd.nist.gov/vuln/detail/CVE-2025-13372) - [https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf](https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf) - [https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0](https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0) - [https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e](https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e) - [https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355](https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355) - [https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d](https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2025/dec/02/security-releases](https://www.djangoproject.com/weblog/2025/dec/02/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-rqw2-ghq9-44m7) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django is vulnerable to DoS via XML serializer text extraction BIT-django-2025-64460 / [CVE-2025-64460](https://nvd.nist.gov/vuln/detail/CVE-2025-64460) / [GHSA-vrcr-9hj9-jcg6](https://github.com/advisories/GHSA-vrcr-9hj9-jcg6) <details> <summary>More information</summary> #### Details An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2025-64460](https://nvd.nist.gov/vuln/detail/CVE-2025-64460) - [https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b](https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b) - [https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5](https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5) - [https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0](https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0) - [https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d](https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2025/dec/02/security-releases](https://www.djangoproject.com/weblog/2025/dec/02/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-vrcr-9hj9-jcg6) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django has Observable Timing Discrepancy BIT-django-2025-13473 / [CVE-2025-13473](https://nvd.nist.gov/vuln/detail/CVE-2025-13473) / [GHSA-2mcm-79hx-8fxw](https://github.com/advisories/GHSA-2mcm-79hx-8fxw) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue. #### Severity - CVSS Score: 2.7 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2025-13473](https://nvd.nist.gov/vuln/detail/CVE-2025-13473) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/feb/03/security-releases](https://www.djangoproject.com/weblog/2026/feb/03/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2mcm-79hx-8fxw) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django has Inefficient Algorithmic Complexity BIT-django-2025-14550 / [CVE-2025-14550](https://nvd.nist.gov/vuln/detail/CVE-2025-14550) / [GHSA-33mw-q7rj-mjwj](https://github.com/advisories/GHSA-33mw-q7rj-mjwj) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue. #### Severity - CVSS Score: 2.7 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2025-14550](https://nvd.nist.gov/vuln/detail/CVE-2025-14550) - [https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb](https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/feb/03/security-releases](https://www.djangoproject.com/weblog/2026/feb/03/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-33mw-q7rj-mjwj) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django has Inefficient Algorithmic Complexity BIT-django-2026-1285 / [CVE-2026-1285](https://nvd.nist.gov/vuln/detail/CVE-2026-1285) / [GHSA-4rrr-2h4v-f3j9](https://github.com/advisories/GHSA-4rrr-2h4v-f3j9) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. #### Severity - CVSS Score: 2.7 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-1285](https://nvd.nist.gov/vuln/detail/CVE-2026-1285) - [https://github.com/django/django/commit/a33540b3e20b5d759aa8b2e4b9ca0e8edd285344](https://github.com/django/django/commit/a33540b3e20b5d759aa8b2e4b9ca0e8edd285344) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/feb/03/security-releases](https://www.djangoproject.com/weblog/2026/feb/03/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4rrr-2h4v-f3j9) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django has an SQL Injection issue BIT-django-2026-1312 / [CVE-2026-1312](https://nvd.nist.gov/vuln/detail/CVE-2026-1312) / [GHSA-6426-9fv3-65x8](https://github.com/advisories/GHSA-6426-9fv3-65x8) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue. #### Severity - CVSS Score: 5.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-1312](https://nvd.nist.gov/vuln/detail/CVE-2026-1312) - [https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84](https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84) - [https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222](https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/feb/03/security-releases](https://www.djangoproject.com/weblog/2026/feb/03/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6426-9fv3-65x8) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django has an SQL Injection issue BIT-django-2026-1287 / [CVE-2026-1287](https://nvd.nist.gov/vuln/detail/CVE-2026-1287) / [GHSA-gvg8-93h5-g6qq](https://github.com/advisories/GHSA-gvg8-93h5-g6qq) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue. #### Severity - CVSS Score: 8.1 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-1287](https://nvd.nist.gov/vuln/detail/CVE-2026-1287) - [https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22](https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/feb/03/security-releases](https://www.djangoproject.com/weblog/2026/feb/03/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-gvg8-93h5-g6qq) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django has an SQL Injection issue BIT-django-2026-1207 / [CVE-2026-1207](https://nvd.nist.gov/vuln/detail/CVE-2026-1207) / [GHSA-mwm9-4648-f68q](https://github.com/advisories/GHSA-mwm9-4648-f68q) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue. #### Severity - CVSS Score: 8.1 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-1207](https://nvd.nist.gov/vuln/detail/CVE-2026-1207) - [https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8](https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/feb/03/security-releases](https://www.djangoproject.com/weblog/2026/feb/03/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-mwm9-4648-f68q) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django vulnerable to Uncontrolled Resource Consumption BIT-django-2026-25673 / [CVE-2026-25673](https://nvd.nist.gov/vuln/detail/CVE-2026-25673) / [GHSA-8p8v-wh79-9r56](https://github.com/advisories/GHSA-8p8v-wh79-9r56) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-25673](https://nvd.nist.gov/vuln/detail/CVE-2026-25673) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/mar/03/security-releases](https://www.djangoproject.com/weblog/2026/mar/03/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-8p8v-wh79-9r56) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django has a Race Condition vulnerability BIT-django-2026-25674 / [CVE-2026-25674](https://nvd.nist.gov/vuln/detail/CVE-2026-25674) / [GHSA-mjgh-79qc-68w3](https://github.com/advisories/GHSA-mjgh-79qc-68w3) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary `umask` change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue. #### Severity - CVSS Score: 3.7 / 10 (Low) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-25674](https://nvd.nist.gov/vuln/detail/CVE-2026-25674) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/mar/03/security-releases](https://www.djangoproject.com/weblog/2026/mar/03/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-mjgh-79qc-68w3) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django has potential DoS via MultiPartParser through crafted multipart uploads [CVE-2026-33033](https://nvd.nist.gov/vuln/detail/CVE-2026-33033) / [GHSA-5mf9-h53q-7mhq](https://github.com/advisories/GHSA-5mf9-h53q-7mhq) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. #### Severity - CVSS Score: 6.5 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-33033](https://nvd.nist.gov/vuln/detail/CVE-2026-33033) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/apr/07/security-releases](https://www.djangoproject.com/weblog/2026/apr/07/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-5mf9-h53q-7mhq) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit [CVE-2026-33034](https://nvd.nist.gov/vuln/detail/CVE-2026-33034) / [GHSA-933h-hp56-hf7m](https://github.com/advisories/GHSA-933h-hp56-hf7m) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-33034](https://nvd.nist.gov/vuln/detail/CVE-2026-33034) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/apr/07/security-releases](https://www.djangoproject.com/weblog/2026/apr/07/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-933h-hp56-hf7m) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django vulnerable to privilege abuse in ModelAdmin.list_editable [CVE-2026-4292](https://nvd.nist.gov/vuln/detail/CVE-2026-4292) / [GHSA-mmwr-2jhp-mc7j](https://github.com/advisories/GHSA-mmwr-2jhp-mc7j) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue. #### Severity - CVSS Score: 2.7 / 10 (Low) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-4292](https://nvd.nist.gov/vuln/detail/CVE-2026-4292) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/apr/07/security-releases](https://www.djangoproject.com/weblog/2026/apr/07/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-mmwr-2jhp-mc7j) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django vulnerable to ASGI header spoofing via underscore/hyphen conflation [CVE-2026-3902](https://nvd.nist.gov/vuln/detail/CVE-2026-3902) / [GHSA-mvfq-ggxm-9mc5](https://github.com/advisories/GHSA-mvfq-ggxm-9mc5) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-3902](https://nvd.nist.gov/vuln/detail/CVE-2026-3902) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/apr/07/security-releases](https://www.djangoproject.com/weblog/2026/apr/07/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-mvfq-ggxm-9mc5) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Django vulnerable to privilege abuse in GenericInlineModelAdmin [CVE-2026-4277](https://nvd.nist.gov/vuln/detail/CVE-2026-4277) / [GHSA-pwjp-ccjc-ghwg](https://github.com/advisories/GHSA-pwjp-ccjc-ghwg) <details> <summary>More information</summary> #### Details An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-4277](https://nvd.nist.gov/vuln/detail/CVE-2026-4277) - [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security) - [https://github.com/django/django](https://github.com/django/django) - [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce) - [https://www.djangoproject.com/weblog/2026/apr/07/security-releases](https://www.djangoproject.com/weblog/2026/apr/07/security-releases) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-pwjp-ccjc-ghwg) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>django/django (django)</summary> ### [`v5.2.13`](https://github.com/django/django/compare/5.2.12...5.2.13) [Compare Source](https://github.com/django/django/compare/5.2.12...5.2.13) ### [`v5.2.12`](https://github.com/django/django/compare/5.2.11...5.2.12) [Compare Source](https://github.com/django/django/compare/5.2.11...5.2.12) ### [`v5.2.11`](https://github.com/django/django/compare/5.2.10...5.2.11) [Compare Source](https://github.com/django/django/compare/5.2.10...5.2.11) ### [`v5.2.10`](https://github.com/django/django/compare/5.2.9...5.2.10) [Compare Source](https://github.com/django/django/compare/5.2.9...5.2.10) ### [`v5.2.9`](https://github.com/django/django/compare/5.2.8...5.2.9) [Compare Source](https://github.com/django/django/compare/5.2.8...5.2.9) ### [`v5.2.8`](https://github.com/django/django/compare/5.2.7...5.2.8) [Compare Source](https://github.com/django/django/compare/5.2.7...5.2.8) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMTUiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMTAuMTUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->
Update dependency django to v5.2.13 [SECURITY]
All checks were successful
ci / build-image (push) Successful in 15s
Details
cb5a340153
jonathan deleted branch renovate/pypi-django-vulnerability 2026-04-12 21:17:04 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
jonathan/min.ie!6
No description provided.