Update dependency django to v5 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
django (changelog)	3.2.19 → 5.2.16

---

Django Denial of service vulnerability in django.utils.encoding.uri_to_iri

CVE-2023-41164 / GHSA-7h4p-27mh-hmrw

More information

Details

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-41164
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/6f030b1149bd8fa4ba90452e77cb3edc095ce54e
• https://github.com/django/django/commit/9c51b4dcfa0cefcb48231f4d71cafa80821f87b9
• https://github.com/django/django/commit/ba00bc5ec6a7eff5e08be438f7b5b0e9574e8ff0
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-225.yaml
• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/4.2/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU
• https://security.netapp.com/advisory/ntap-20231214-0002
• https://www.djangoproject.com/weblog/2023/sep/04/security-releases
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://github.com/advisories/GHSA-7h4p-27mh-hmrw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Regular expression denial-of-service in Django

CVE-2024-27351 / GHSA-vm8q-m57g-pff3

More information

Details

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-27351
• https://docs.djangoproject.com/en/5.0/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/mar/04/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-47.yaml
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• http://www.openwall.com/lists/oss-security/2024/03/04/1
• https://github.com/django/django/commit/072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521
• https://github.com/django/django/commit/3394fc6132436eca89e997083bae9985fb7e761e
• https://github.com/django/django/commit/3c9a2771cc80821e041b16eb36c1c37af5349d4a
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6
• https://github.com/advisories/GHSA-vm8q-m57g-pff3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django denial-of-service attack in the intcomma template filter

CVE-2024-24680 / GHSA-xxj9-f6rv-m3x4

More information

Details

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-24680
• https://groups.google.com/forum/#%21forum/django-announce
• https://github.com/django/django/commit/16a8fe18a3b81250f4fa57e3f93f0599dc4895bc
• https://github.com/django/django/commit/55519d6cf8998fe4c8f5c8abffc2b10a7c3d14e9
• https://github.com/django/django/commit/572ea07e84b38ea8de0551f4b4eda685d91d09d2
• https://github.com/django/django/commit/c1171ffbd570db90ca206c30f8e2b9f691243820
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-28.yaml
• https://docs.djangoproject.com/en/5.0/releases/security
• https://www.djangoproject.com/weblog/2024/feb/06/security-releases
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6
• https://github.com/advisories/GHSA-xxj9-f6rv-m3x4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Denial-of-service in django.utils.text.Truncator

CVE-2023-43665 / GHSA-h8gc-pgj2-vjm3

More information

Details

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-43665
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/be9c27c4d18c2e6a5be8af4e53c0797440794473
• https://github.com/django/django/commit/c7b7024742250414e426ad49fb80db943e7ba4e8
• https://github.com/django/django/commit/ccdade1a0262537868d7ca64374de3d957ca50c5
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-226.yaml
• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/4.2/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU
• https://security.netapp.com/advisory/ntap-20231221-0001
• https://www.djangoproject.com/weblog/2023/oct/04/security-releases
• http://www.openwall.com/lists/oss-security/2024/03/04/1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://github.com/advisories/GHSA-h8gc-pgj2-vjm3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has regular expression denial of service vulnerability in EmailValidator/URLValidator

CVE-2023-36053 / GHSA-jh3w-4vvf-mjgr

More information

Details

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-36053
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/454f2fb93437f98917283336201b4048293f7582
• https://github.com/django/django/commit/ad0410ec4f458aa39803e5f6b9a3736527062dcd
• https://github.com/django/django/commit/b7c5feb35a31799de6e582ad6a5a91a9de74e0f9
• https://github.com/django/django/commit/beb3f3d55940d9aa7198bf9d424ab74e873aec3d
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-100.yaml
• https://lists.debian.org/debian-lts-announce/2023/07/msg00022.html
• https://www.debian.org/security/2023/dsa-5465
• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/4.2/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS
• https://www.djangoproject.com/weblog/2023/jul/03/security-releases
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://github.com/advisories/GHSA-jh3w-4vvf-mjgr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django potential denial of service vulnerability in UsernameField on Windows

CVE-2023-46695 / GHSA-qmf9-6jqf-j8fq

More information

Details

An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-46695
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/048a9ebb6ea468426cb4e57c71572cbbd975517f
• https://github.com/django/django/commit/4965bfdde2e5a5c883685019e57d123a3368a75e
• https://github.com/django/django/commit/f9a7fb8466a7ba4857eaf930099b5258f3eafb2b
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-222.yaml
• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/4.2/releases/security
• https://security.netapp.com/advisory/ntap-20231214-0001
• https://www.djangoproject.com/weblog/2023/nov/01/security-releases
• https://github.com/advisories/GHSA-qmf9-6jqf-j8fq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django allows enumeration of user e-mail addresses

CVE-2024-45231 / GHSA-rrqc-c2jx-6jgv

More information

Details

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-45231
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/sep/03/security-releases
• https://github.com/django/django/commit/3c733c78d6f8e50296d6e248968b6516c92a53ca
• https://github.com/django/django/commit/96d84047715ea1715b4bd1594e46122b8a77b9e2
• https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199
• https://github.com/advisories/GHSA-rrqc-c2jx-6jgv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Improper Output Neutralization for Logs vulnerability

CVE-2025-48432 / GHSA-7xr5-9hcq-chf9

More information

Details

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-48432
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/jun/04/security-releases
• http://www.openwall.com/lists/oss-security/2025/06/04/5
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-47.yaml
• https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases
• http://www.openwall.com/lists/oss-security/2025/06/10/2
• http://www.openwall.com/lists/oss-security/2025/06/10/3
• http://www.openwall.com/lists/oss-security/2025/06/10/4
• https://github.com/advisories/GHSA-7xr5-9hcq-chf9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django is subject to SQL injection through its column aliases

CVE-2025-57833 / GHSA-6w2r-r2m5-xq5w

More information

Details

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-57833
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://medium.com/@​EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898
• https://www.djangoproject.com/weblog/2025/sep/03/security-releases
• https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5
• https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92
• https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243
• https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html
• http://www.openwall.com/lists/oss-security/2025/09/03/3
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-105.yaml
• https://github.com/advisories/GHSA-6w2r-r2m5-xq5w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

CVE-2025-64459 / GHSA-frmv-pr5f-9mcr

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64459
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
• https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
• https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
• https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
• https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html
• https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-108.yaml
• https://github.com/advisories/GHSA-frmv-pr5f-9mcr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

CVE-2025-64458 / GHSA-qw25-v68c-qjf3

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64458
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
• https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
• https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
• https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml
• https://github.com/advisories/GHSA-qw25-v68c-qjf3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: has_vary_header may expose cached responses when Vary values contain whitespace

CVE-2026-48587 / GHSA-923m-gv2p-w5qp

More information

Details

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
django.utils.cache.has_vary_header() in Django does not strip leading or trailing whitespace from Vary response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Navid Rezazadeh for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-48587
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases
• https://github.com/django/django/commit/1721035a72624aad7b38dd19b14013efd94b24b8
• https://github.com/django/django/commit/42aa0b3364d312e7c6472258d8b0e9c0277fbf22
• https://github.com/django/django/commit/9b62b0af71a14c657d19d95371630ba839e83d9a
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-198.yaml
• https://github.com/advisories/GHSA-923m-gv2p-w5qp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: GDALRaster may over-read heap memory when constructed from bytes

CVE-2026-53877 / GHSA-crhf-3pfg-w68w

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
django.contrib.gis.gdal.GDALRaster over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the vsi_buffer property is accessed.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53877
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/38dfbd27d7d4f4e6eaa087d7a90f2613fbf55b3a
• https://github.com/django/django/commit/6c66eb8cec52b303af85c2c6e4dd00aa37654dbc
• https://github.com/django/django/commit/6ca2bbe2efce21010eff48f1f36a3f621d698ed8
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2091.yaml
• https://github.com/advisories/GHSA-crhf-3pfg-w68w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

CVE-2026-8404 / GHSA-8cjm-8mp7-r2xf

More information

Details

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their Cache-Control directives used uppercase or mixed-case values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Ahmed Badawe for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-8404
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases
• https://github.com/django/django/commit/366d9ae6e8d1469c04e9ebdc1bcd098fc14a3b1e
• https://github.com/django/django/commit/b4330259ffbe1a031ed14daab1f35697460f10f2
• https://github.com/django/django/commit/d618d7ae4fec727d5b582bd24f803c28d17bf7cd
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-201.yaml
• https://github.com/advisories/GHSA-8cjm-8mp7-r2xf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

CVE-2026-53878 / GHSA-8qcx-xf44-272x

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
DomainNameValidator does not prohibit newlines in domain names (unless used via a form field, since CharField strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53878
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/3a720d0d8bf2529253b98968f10ca73daf6d693c
• https://github.com/django/django/commit/a5de13f1491f1dbf2bb0ad9b91570524ebbc8acd
• https://github.com/django/django/commit/d5d60ed0323cddaa0ce0237a26a3d49ac21ee05e
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2092.yaml
• https://github.com/advisories/GHSA-8qcx-xf44-272x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: signed cookies are vulnerable to salt namespace collisions

CVE-2026-6873 / GHSA-h7pc-vwp9-298g

More information

Details

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
django.http.HttpRequest.get_signed_cookie in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct (name, salt) pairs that produce the same concatenation.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Peng Zhou for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-6873
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases
• https://github.com/django/django/commit/594360cbf58be7f56eb6da96d58644297c99ef85
• https://github.com/django/django/commit/70d36515b9cc71700105a14b275583070d48b689
• https://github.com/django/django/commit/c807d9c398022d23cb27518fa6ecaf343efb30cf
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-199.yaml
• https://github.com/advisories/GHSA-h7pc-vwp9-298g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: cache middleware may expose private responses when unrelated request cookies are present

CVE-2026-48588 / GHSA-3h9f-r86x-qvjx

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
UpdateCacheMiddleware and the cache_page() decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Chris Whyland for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-48588
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3
• https://github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1
• https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yaml
• https://github.com/advisories/GHSA-3h9f-r86x-qvjx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

django/django (django)

v5.2.16

Compare Source

v5.2.15

Compare Source

v5.2.14

Compare Source

v5.2.13

Compare Source

v5.2.12

Compare Source

v5.2.11

Compare Source

v5.2.10

Compare Source

v5.2.9

Compare Source

v5.2.8

Compare Source

v5.2.7

Compare Source

v5.2.6

Compare Source

v5.2.5

Compare Source

v5.2.4

Compare Source

v5.2.3

Compare Source

v5.2.2

Compare Source

v5.2.1

Compare Source

v5.2

Compare Source

v5.1.15

Compare Source

v5.1.14

Compare Source

v5.1.13

Compare Source

v5.1.12

Compare Source

v5.1.11

Compare Source

v5.1.10

Compare Source

v5.1.9

Compare Source

v5.1.8

Compare Source

v5.1.7

Compare Source

v5.1.6

Compare Source

v5.1.5

Compare Source

v5.1.4

Compare Source

v5.1.3

Compare Source

v5.1.2

Compare Source

v5.1.1

Compare Source

v5.1

Compare Source

v5.0.14

Compare Source

v5.0.13

Compare Source

v5.0.12

Compare Source

v5.0.11

Compare Source

v5.0.10

Compare Source

v5.0.9

Compare Source

v5.0.8

Compare Source

v5.0.7

Compare Source

v5.0.6

Compare Source

v5.0.5

Compare Source

v5.0.4

Compare Source

v5.0.3

Compare Source

[v5.0.2](https://redirect.github.com

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.