Skip to content
OpenAdvisories
Medium WID-SEC-2026-1002 5 CVEs

Django: Mehrere Schwachstellen

Published Apr 7, 2026 · Updated Jun 7, 2026 · Revision 8 · de-DE

Vendor: Fedora Vendor: SUSE Vendor: Ubuntu Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.

Product

Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt.

Vulnerabilities 5

  • Critical 9.8
    CVE-2026-4277

    Privilege abuse in GenericInlineModelAdmin

    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2026-33034

    Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass

    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`, allowing remote at…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2026-3902

    ASGI header spoofing via underscore/hyphen conflation

    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version wit…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 6.5
    CVE-2026-33033 Public exploit

    Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Ea…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Low 2.7
    CVE-2026-4292

    Privilege abuse in ModelAdmin.list_editable

    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as …

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

Revision history

  1. #8

    Neue Updates von Fedora aufgenommen

  2. #7

    Neue Updates von Fedora aufgenommen

  3. #6

    Neue Updates von SUSE aufgenommen

  4. #5

    Neue Updates von openSUSE aufgenommen

  5. #4

    Neue Updates von openSUSE aufgenommen

  6. #3

    Neue Updates von openSUSE aufgenommen

  7. #2

    Neue Updates von Ubuntu aufgenommen

  8. #1

    Initiale Fassung

References