The Django project team has released security updates for supported release streams, issuing versions 6.1.2, 6.0.9, and 5.2.18. The maintenance patches resolve four distinct security issues ranging from low to moderate severity, including potential denial-of-service vectors, server-side request forgery risks in GIS components, and unauthorized instance modifications in model formsets.
Denial-of-Service Defenses in Header and Translation Utilities
Two of the addressed security issues involve potential denial-of-service conditions. Under CVE-2026-77050, rated low severity, the get_supported_language_variant function stored unchecked, excessively long language codes into an in-memory cache, creating a risk of excessive memory consumption. Django now limits or truncates language codes longer than 500 characters prior to cache lookups.
The second denial-of-service vector, CVE-2026-84429, carries a moderate severity rating and stems from quadratic time complexity when parse_header_parameters processes quoted parameter values with numerous separators. Unauthenticated requests targeting headers like Accept or Content-Type could trigger this behavior. To resolve the flaw, Django switched the underlying parser in parse_header_parameters to Python's built-in email.message.Message module, which may slightly alter how malformed header values are decoded.
Spatial Lookup Changes to Block Request Forgery
Categorized under CVE-2026-87890 as moderate severity, Django fixed a flaw where spatial lookups accepted raw raster byte values without requiring explicit instantiation via GDALRaster. Because these raw bytes were evaluated through GDAL's in-memory virtual filesystem, an attacker could supply a VRT document referencing remote raster targets, leading the server to issue unintended network requests under the Django process user.
To fix the issue, Django introduced a backward-incompatible change requiring raster byte inputs to be wrapped in GDALRaster before being passed to spatial queries, though valid hexadecimal geometry byte strings remain permitted.
Formset Privilege Escalation and Upgrade Guidance
Under CVE-2026-87975, rated moderate severity, model formsets with editable primary keys contained a vulnerability where forged POST requests could bypass queryset boundaries to delete or create records via edit-only formsets. The issue affects models using primary keys configured through editable fields, such as custom UUIDs, natural keys, or OneToOneField setups, while models using default BigAutoField primary keys remain unaffected.
Patches have been applied across main, 6.1, 6.0, and 5.2 branches. Django maintainers advise all developers running impacted releases to update immediately to Django 6.1.2, 6.0.9, or 5.2.18.
AI-generated editorial illustration; not a documentary photograph.
Source: Django security releases issued: 6.1.2, 6.0.9, and 5.2.18
SIGNAL TITANS
Leave a Reply