October 6, 2026
Django 5.2.18 fixes one security issue with severity “low”, three security issues with severity “moderate”, and provides a fix for an insufficient security mitigation in 5.2.17. It also fixes one data loss issue in 4.0.
get_supported_language_variant()¶get_supported_language_variant() was subject to
a potential denial-of-service attack when processing many distinct, very long
language codes. Language codes were used as keys in an in-memory cache before
their length was limited, potentially consuming excessive process memory.
To mitigate this vulnerability, language codes longer than 500 characters are now rejected or truncated before the cached lookup.
This issue has severity “low” according to the Django security policy.
django.utils.http.parse_header_parameters() was subject to a potential
denial-of-service attack due to quadratic time complexity when parsing a value
with many separators inside a quoted parameter. An unauthenticated request
could reach this parsing through headers such as Accept or
Content-Type, for instance via the content negotiation performed by
HttpRequest.accepts(). The per-call length limit does not bound the
combined size of repeated headers.
The undocumented django.utils.http.parse_header_parameters() function now
uses Python’s email.message.Message for parsing. As a result, parsing
of some malformed or unusual header values may differ, for example,
RFC 2231 values with a missing encoding are now decoded.
This issue has severity “moderate” according to the Django security policy.
Spatial lookups accepted raster values provided as bytes without requiring
them to be explicitly wrapped in GDALRaster.
Although these values were opened through GDAL’s in-memory virtual filesystem,
they could contain a VRT document referencing an external raster source. This
could cause GDAL to issue network requests as the Django process user while
preparing the lookup.
This issue could be exploited by applications that passed attacker-controlled bytes directly to a spatial lookup. It was overlooked in the fix for CVE-2026-15307.
To mitigate this issue, raster values provided as bytes must now be wrapped
in GDALRaster before being used in spatial
lookups. Byte values representing valid hexadecimal geometries remain accepted.
This is a backward incompatible change. As a reminder, all untrusted user input should be validated before use.
This issue has severity “moderate” according to the Django security policy.
Model formsets incorrectly allowed forged POST data to either delete
instances outside the limiting queryset or create instances via edit-only formsets when the model’s primary key could be set
through the form, such as with: a OneToOneField (or parent link used as the
primary key of an inline formset’s model), or a natural or UUID primary key
included in the form’s fields. Models using the default BigAutoField
primary key were not affected.
This issue has severity “moderate” according to the Django security policy.
Fixed a class of bugs in Django 6.0.8 that allowed bypassing the depth limiter for deeply nested geometry collections (CVE 2026-15830). The new algorithm treats WKB and WKT inputs more consistently and also fixes a rare case where a valid geometry could have been rejected.
Fixed a data loss issue in Django 4.0 where network rasters were deleted by GeoDjango when closed.
Oct 06, 2026