Skip to content
OpenAdvisories
Medium WID-SEC-2026-0297 6 CVEs

Django: Mehrere Schwachstellen

Published Feb 3, 2026 · Updated Jul 9, 2026 · Revision 16 · de-DE

Vendor: Debian Vendor: Fedora Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Django ausnutzen, um SQL-Injektionen durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt.

Vulnerabilities 6

  • High 7.5
    CVE-2025-14550

    Potential denial-of-service vulnerability via repeated headers when using ASGI

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (suc…

    djangoproject Django asgiref python-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2026-1285

    Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remo…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 5.4
    CVE-2026-1207 Public exploit Scanner template EPSS 13%

    Potential SQL injection via raster lookups on PostGIS

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 5.4
    CVE-2026-1287

    Potential SQL injection in column aliases via control characters

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` p…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 5.4
    CVE-2026-1312 Public exploit

    Potential SQL injection via QuerySet.order_by and FilteredRelation

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansi…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 5.3
    CVE-2025-13473

    Username enumeration through timing difference in mod_wsgi authentication handler

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earli…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

Revision history

  1. #16

    CVE-2026-1207 wird ausgenutzt

  2. #15

    Neue Updates von Red Hat aufgenommen

  3. #14

    Neue Updates von Red Hat aufgenommen

  4. #13

    Neue Updates von Red Hat aufgenommen

  5. #12

    Neue Updates von Red Hat aufgenommen

  6. #11

    Neue Updates von Red Hat aufgenommen

  7. #10

    Neue Updates von Red Hat aufgenommen

  8. #9

    Neue Updates von Debian aufgenommen

  9. #8

    Neue Updates von openSUSE aufgenommen

  10. #7

    Neue Updates von Fedora und Debian aufgenommen

  11. #6

    Neue Updates von openSUSE aufgenommen

  12. #5

    Neue Updates von SUSE aufgenommen

  13. #4

    Neue Updates von openSUSE aufgenommen

  14. #3

    Neue Updates von openSUSE aufgenommen

  15. #2

    Neue Updates von openSUSE aufgenommen

  16. #1

    Initiale Fassung

References