Skip to content
OpenAdvisories
High USN-8848-1 3 CVEs

python-django vulnerabilities

Published Sep 30, 2026 · Updated Oct 2, 2026

Ecosystem: Ubuntu

Summary

Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial
lookups when processing untrusted input. A remote attacker could possibly
use this issue to make outbound network requests, write arbitrary files, or
execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-15307)

Ahmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly
cached requests where the Vary header contained an asterisk. A remote
attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-6907)

Ahmed Badawe discovered that Django did not properly parse Cache-Control
response directives case-insensitively under certain circumstances. A
remote attacker could possibly use this issue to view sensitive information
from responses that were incorrectly cached. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-8404)

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS python-django 2:3.2.12-2ubuntu1.29
Ubuntu · 24.04 LTS 24.04:LTS python-django 3:4.2.11-1ubuntu1.18
Ubuntu · 26.04 LTS 26.04:LTS python-django 3:5.2.9-0ubuntu4.3
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS python-django 1.6.11-0ubuntu1.3+esm12
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS python-django 1.8.7-1ubuntu5.15+esm13
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS python-django 1:1.11.11-1ubuntu1.21+esm17
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-django 2:2.2.12-1ubuntu0.29+esm10

Vulnerabilities 3

  • High 8.8
    CVE-2026-15307

    Server-side file-write and request forgery via spatial lookups

    An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial l…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 4.3
    CVE-2026-6907

    Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware

    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlie…

    djangoproject Django python-django django Debian Ubuntu Alpine Wolfi PyPI
  • Low 3.1
    CVE-2026-8404

    Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware

    An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that wer…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2026-6907
  • report
    https://ubuntu.com/security/CVE-2026-8404
  • report
    https://ubuntu.com/security/CVE-2026-15307