Skip to content
OpenAdvisories
Medium WID-SEC-2026-3780 4 CVEs

Django: Mehrere Schwachstellen

Published Oct 6, 2026 · Updated Nov 1, 2026 · Revision 8 · de-DE

Vendor: Debian Vendor: Fedora Vendor: SUSE Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt.

Vulnerabilities 4

  • Medium 5.3
    CVE-2026-77050

    Potential denial-of-service vulnerability in get_supported_language_variant()

    An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service attack when processing many distinct, very long language codes…

    djangoproject Django python-django python-django Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-84429

    Potential denial-of-service vulnerability in HTTP header parsing

    An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many sepa…

    djangoproject Django python-django python-django Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-87890

    Potential request forgery via spatial lookup byte values

    An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests v…

    djangoproject Django python-django python-django Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2026-87975

    Privilege abuse in model formsets with editable primary keys

    An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence that the instance belonge…

    djangoproject Django python-django python-django Debian Ubuntu Alpine

Revision history

  1. #8

    Neue Updates von openSUSE aufgenommen

  2. #7

    Neue Updates von openSUSE aufgenommen

  3. #6

    Neue Updates von openSUSE aufgenommen

  4. #5

    Neue Updates von openSUSE aufgenommen

  5. #4

    Neue Updates von Debian aufgenommen

  6. #3

    Neue Updates von SUSE aufgenommen

  7. #2

    Neue Updates von Fedora aufgenommen

  8. #1

    Initiale Fassung

References