Update dependency Django to v5 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
Django (changelog)	^4.0.6 → ^5.0.0

---

Django vulnerable to Reflected File Download attack

CVE-2022-36359 / GHSA-8x94-hmjh-97hq

More information

Details

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-36359
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml
• https://groups.google.com/g/django-announce/c/8cz--gvaJr4
• http://www.openwall.com/lists/oss-security/2022/08/03/1
• https://www.debian.org/security/2022/dsa-5254
• https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b80
• https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb3
• https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://security.netapp.com/advisory/ntap-20220915-0008
• https://www.djangoproject.com/weblog/2022/aug/03/security-releases
• https://github.com/advisories/GHSA-8x94-hmjh-97hq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django denial-of-service vulnerability in internationalized URLs

CVE-2022-41323 / GHSA-qrw5-5h28-6cmg

More information

Details

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-41323
• https://github.com/django/django/commit/5b6b257fa7ec37ff27965358800c67e2dd11c924
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-304.yaml
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/23f0093125ac2e553da6c1b2f9988eb6a3dd2ea1
• https://github.com/django/django/commit/9d656ea51d9ea7105c0c0785783ac29d426a7d25
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP
• https://security.netapp.com/advisory/ntap-20221124-0001
• https://www.djangoproject.com/weblog/2022/oct/04/security-releases
• https://github.com/advisories/GHSA-qrw5-5h28-6cmg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django contains Uncontrolled Resource Consumption via cached header

CVE-2023-23969 / GHSA-q2jf-h9jm-m7p4

More information

Details

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-23969
• https://lists.debian.org/debian-lts-announce/2023/02/msg00000.html
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/4452642f193533e288a52c02efb5bbc766a68f95
• https://github.com/django/django/commit/9d7bd5a56b1ce0576e8e07a8001373576d277942
• https://github.com/django/django/commit/c7e0151fdf33e1b11d488b6f67b94fdf3a30614a
• https://docs.djangoproject.com/en/4.1/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://security.netapp.com/advisory/ntap-20230302-0007
• https://www.djangoproject.com/weblog/2023/feb/01/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-12.yaml
• https://github.com/advisories/GHSA-q2jf-h9jm-m7p4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Resource exhaustion in Django

CVE-2023-24580 / GHSA-2hrw-hx67-34x6

More information

Details

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-24580
• https://groups.google.com/forum/#!forum/django-announce
• http://www.openwall.com/lists/oss-security/2023/02/14/1
• https://github.com/django/django/commit/628b33a854a9c68ec8a0c51f382f304a0044ec92
• https://github.com/django/django/commit/83f1ea83e4553e211c1c5a0dfc197b66d4e50432
• https://github.com/django/django/commit/a665ed5179f5bbd3db95ce67286d0192eff041d8
• https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html
• https://docs.djangoproject.com/en/4.1/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP
• https://security.netapp.com/advisory/ntap-20230316-0006
• https://www.djangoproject.com/weblog/2023/feb/14/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-13.yaml
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B
• https://groups.google.com/forum/#%21forum/django-announce
• https://github.com/advisories/GHSA-2hrw-hx67-34x6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django bypasses validation when using one form field to upload multiple files

CVE-2023-31047 / GHSA-r3xc-prgr-mg9p

More information

Details

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-31047
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/21b1b1fc03e5f9e9f8c977ee6e35618dd3b353dd
• https://github.com/django/django/commit/e7c3a2ccc3a562328600be05068ed9149e12ce64
• https://github.com/django/django/commit/eed53d0011622e70b936e203005f0e6f4ac48965
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-61.yaml
• https://docs.djangoproject.com/en/4.2/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD
• https://security.netapp.com/advisory/ntap-20230609-0008
• https://www.djangoproject.com/weblog/2023/may/03/security-releases
• https://github.com/advisories/GHSA-r3xc-prgr-mg9p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has regular expression denial of service vulnerability in EmailValidator/URLValidator

CVE-2023-36053 / GHSA-jh3w-4vvf-mjgr

More information

Details

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-36053
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/454f2fb93437f98917283336201b4048293f7582
• https://github.com/django/django/commit/ad0410ec4f458aa39803e5f6b9a3736527062dcd
• https://github.com/django/django/commit/b7c5feb35a31799de6e582ad6a5a91a9de74e0f9
• https://github.com/django/django/commit/beb3f3d55940d9aa7198bf9d424ab74e873aec3d
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-100.yaml
• https://lists.debian.org/debian-lts-announce/2023/07/msg00022.html
• https://www.debian.org/security/2023/dsa-5465
• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/4.2/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS
• https://www.djangoproject.com/weblog/2023/jul/03/security-releases
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://github.com/advisories/GHSA-jh3w-4vvf-mjgr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django allows enumeration of user e-mail addresses

CVE-2024-45231 / GHSA-rrqc-c2jx-6jgv

More information

Details

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-45231
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/sep/03/security-releases
• https://github.com/django/django/commit/3c733c78d6f8e50296d6e248968b6516c92a53ca
• https://github.com/django/django/commit/96d84047715ea1715b4bd1594e46122b8a77b9e2
• https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199
• https://github.com/advisories/GHSA-rrqc-c2jx-6jgv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Improper Output Neutralization for Logs vulnerability

CVE-2025-48432 / GHSA-7xr5-9hcq-chf9

More information

Details

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-48432
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/jun/04/security-releases
• http://www.openwall.com/lists/oss-security/2025/06/04/5
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-47.yaml
• https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases
• http://www.openwall.com/lists/oss-security/2025/06/10/2
• http://www.openwall.com/lists/oss-security/2025/06/10/3
• http://www.openwall.com/lists/oss-security/2025/06/10/4
• https://github.com/advisories/GHSA-7xr5-9hcq-chf9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django is subject to SQL injection through its column aliases

CVE-2025-57833 / GHSA-6w2r-r2m5-xq5w

More information

Details

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-57833
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://medium.com/@​EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898
• https://www.djangoproject.com/weblog/2025/sep/03/security-releases
• https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5
• https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92
• https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243
• https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html
• http://www.openwall.com/lists/oss-security/2025/09/03/3
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-105.yaml
• https://github.com/advisories/GHSA-6w2r-r2m5-xq5w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

CVE-2025-64459 / GHSA-frmv-pr5f-9mcr

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64459
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
• https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
• https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
• https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
• https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html
• https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-108.yaml
• https://github.com/advisories/GHSA-frmv-pr5f-9mcr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

CVE-2025-64458 / GHSA-qw25-v68c-qjf3

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64458
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
• https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
• https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
• https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml
• https://github.com/advisories/GHSA-qw25-v68c-qjf3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: has_vary_header may expose cached responses when Vary values contain whitespace

CVE-2026-48587 / GHSA-923m-gv2p-w5qp

More information

Details

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
django.utils.cache.has_vary_header() in Django does not strip leading or trailing whitespace from Vary response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Navid Rezazadeh for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-48587
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases
• https://github.com/django/django/commit/1721035a72624aad7b38dd19b14013efd94b24b8
• https://github.com/django/django/commit/42aa0b3364d312e7c6472258d8b0e9c0277fbf22
• https://github.com/django/django/commit/9b62b0af71a14c657d19d95371630ba839e83d9a
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-198.yaml
• https://github.com/advisories/GHSA-923m-gv2p-w5qp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

CVE-2026-8404 / GHSA-8cjm-8mp7-r2xf

More information

Details

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their Cache-Control directives used uppercase or mixed-case values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Ahmed Badawe for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-8404
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases
• https://github.com/django/django/commit/366d9ae6e8d1469c04e9ebdc1bcd098fc14a3b1e
• https://github.com/django/django/commit/b4330259ffbe1a031ed14daab1f35697460f10f2
• https://github.com/django/django/commit/d618d7ae4fec727d5b582bd24f803c28d17bf7cd
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-201.yaml
• https://github.com/advisories/GHSA-8cjm-8mp7-r2xf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: cache middleware may expose private responses when unrelated request cookies are present

CVE-2026-48588 / GHSA-3h9f-r86x-qvjx

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
UpdateCacheMiddleware and the cache_page() decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Chris Whyland for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-48588
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3
• https://github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1
• https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yaml
• https://github.com/advisories/GHSA-3h9f-r86x-qvjx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: GDALRaster may over-read heap memory when constructed from bytes

CVE-2026-53877 / GHSA-crhf-3pfg-w68w

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
django.contrib.gis.gdal.GDALRaster over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the vsi_buffer property is accessed.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53877
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/38dfbd27d7d4f4e6eaa087d7a90f2613fbf55b3a
• https://github.com/django/django/commit/6c66eb8cec52b303af85c2c6e4dd00aa37654dbc
• https://github.com/django/django/commit/6ca2bbe2efce21010eff48f1f36a3f621d698ed8
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2091.yaml
• https://github.com/advisories/GHSA-crhf-3pfg-w68w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

CVE-2026-53878 / GHSA-8qcx-xf44-272x

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
DomainNameValidator does not prohibit newlines in domain names (unless used via a form field, since CharField strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53878
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/3a720d0d8bf2529253b98968f10ca73daf6d693c
• https://github.com/django/django/commit/a5de13f1491f1dbf2bb0ad9b91570524ebbc8acd
• https://github.com/django/django/commit/d5d60ed0323cddaa0ce0237a26a3d49ac21ee05e
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2092.yaml
• https://github.com/advisories/GHSA-8qcx-xf44-272x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: signed cookies are vulnerable to salt namespace collisions

CVE-2026-6873 / GHSA-h7pc-vwp9-298g

More information

Details

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
django.http.HttpRequest.get_signed_cookie in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct (name, salt) pairs that produce the same concatenation.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Peng Zhou for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-6873
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases
• https://github.com/django/django/commit/594360cbf58be7f56eb6da96d58644297c99ef85
• https://github.com/django/django/commit/70d36515b9cc71700105a14b275583070d48b689
• https://github.com/django/django/commit/c807d9c398022d23cb27518fa6ecaf343efb30cf
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-199.yaml
• https://github.com/advisories/GHSA-h7pc-vwp9-298g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

django/django (Django)

v5.2.16

Compare Source

v5.2.15

Compare Source

v5.2.14

Compare Source

v5.2.13

Compare Source

v5.2.12

Compare Source

v5.2.11

Compare Source

v5.2.10

Compare Source

v5.2.9

Compare Source

v5.2.8

Compare Source

v5.2.7

Compare Source

v5.2.6

Compare Source

v5.2.5

Compare Source

v5.2.4

Compare Source

v5.2.3

Compare Source

v5.2.2

Compare Source

v5.2.1

Compare Source

v5.2

Compare Source

v5.1.15

Compare Source

v5.1.14

Compare Source

v5.1.13

Compare Source

v5.1.12

Compare Source

v5.1.11

Compare Source

v5.1.10

Compare Source

v5.1.9

Compare Source

v5.1.8

Compare Source

v5.1.7

Compare Source

v5.1.6

Compare Source

v5.1.5

Compare Source

v5.1.4

Compare Source

v5.1.3

Compare Source

v5.1.2

Compare Source

v5.1.1

Compare Source

v5.1

Compare Source

v5.0.14

Compare Source

v5.0.13

Compare Source

v5.0.12

Compare Source

v5.0.11

Compare Source

v5.0.10

Compare Source

v5.0.9

[Compare Source](https://redirect.github.com/django/djan

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
elucidate-frontend	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Sep 20, 2024 4:26pm