Django Security Update: 4 CVEs Fixed (SSRF/DoS/LPE)

Vulnerability Overview Django has released security update versions 6.1.2, 6.0.9, and 5.2.18, addressing the following four security vulnerabilities: 1. CVE-2026-77050: Potential denial-of-service vulnerability in 2. CVE-2026-84429: Potential denial-of-service vulnerability in HTTP header parsing 3. CVE-2026-87890: Potential request forgery vulnerability in spatial lookup byte values 4. CVE-2026-87975: Privilege escalation vulnerability regarding editable primary keys in model formsets Affected Versions Django main Django 6.1 Django 6.0 Django 5.2 Remediation CVE-2026-77050: Potential denial-of-service vulnerability in Issue Description: is susceptible to denial-of-service attacks when processing multiple distinct, lengthy language codes. Language codes are used as keys in the in-memory cache, but their length is not limited, potentially leading to excessive process memory consumption. Remediation: Language codes exceeding 500 characters will be rejected or truncated. Fixed Branches: - main branch - 6.1 branch - 6.0 branch - 5.2 branch CVE-2026-84429: Potential denial-of-service vulnerability in HTTP header parsing Issue Description: is susceptible to denial-of-service attacks when handling quoted parameters containing multiple delimiters. Unauthenticated requests can exploit this via headers such as or , resulting in quadratic parsing time complexity. Remediation: Parsing is now handled using to properly manage malformed or anomalous header values. Fixed Branches: - main branch - 6.1 branch - 6.0 branch - 5.2 branch CVE-2026-87890: Potential request forgery vulnerability in spatial lookup byte values Issue Description: Spatial lookups accept raster values in byte format without requiring them to be explicitly wrapped in . These values are opened via GDAL's in-memory virtual filesystem and may contain VRT (Virtual Raster Template) documents referencing external raster sources, potentially causing GDAL to make network requests as the user running the Django process. Remediation: Raster values must be wrapped in prior to use in spatial lookups. Fixed Branches: - main branch - 6.1 branch - 6.0 branch - 5.2 branch CVE-2026-87975: Privilege escalation vulnerability regarding editable primary keys in model formsets Issue Description: Model formsets incorrectly allowed crafted POST data to manipulate the primary key of the model when using formset settings during restricted query set operations or instance creation. Remediation: Privilege issues in model formsets when handling primary keys have been fixed. Fixed Branches: - main branch - 6.1 branch - 6.0 branch - 5.2 branch Released Versions Django 6.1.2 Django 6.0.9 Django 5.2.18 Additional Information PGP Key ID: Sarah Boyce: 3955B19851EA96EF Security Reporting Guidelines: Please report potential security issues via private email to , rather than through Django's Trac instance or Django forums. Code Blocks No Proof of Concept (POC) or exploitation code was included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Django Security Update: 4 CVEs Fixed (SSRF/DoS/LPE)