An executive overview of CVE-2026-15307: A vulnerability was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8, affecting GeoDjango spatial lookups. The issue allows for remote code execution through file writing and outbound network requests. Staff users with view permission in Django admin can be impacted. The vulnerability has a CVSS score of 8.7 and is classified as HIGH. The CVE record was [truncated]
CVE-2026-53878 is a medium-severity vulnerability affecting Django's DomainNameValidator. The issue allows for header injection when newlines are present in domain names, potentially leading to security issues if an application uses these values in HTTP responses. This vulnerability has been patched in Django versions 6.0.7 and 5.2.16. Affected deployments should prioritize updates or mitigations to preve [truncated]
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. The `django.contrib.gis.gdal.GDALRaster` class over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were [truncated]
CVE-2026-48588 is a low-severity vulnerability in Django's UpdateCacheMiddleware and cache_page() decorator. The issue allows remote attackers to read private data from the shared cache when the incoming request carries unrelated cookies. This vulnerability affects Django 6.0 before 6.0.7 and 5.2 before 5.2.16. Earlier, unsupported Django series may also be affected. The vulnerability was reported by Chris Whyland.
CVE-2026-25673 is a high-severity denial of service vulnerability affecting Django's URLField.to_python() function. The issue arises from the function's use of urllib.parse.urlsplit(), which performs NFKC normalization on Windows. This process is disproportionately slow for certain Unicode characters, allowing remote attackers to cause denial of service via large URL inputs containing these characters. Th [truncated]
