Update dependency Django to v4 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
Django (changelog)	==3.0.8 → ==4.2.26

---

Django Incorrect Default Permissions

CVE-2020-24584 / GHSA-fr28-569j-53c4

More information

Details

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-24584
• https://github.com/django/django/commit/1853724acaf17ed7414d54c7d2b5563a25025a71
• https://groups.google.com/forum/#!topic/django-announce/Gdqn58RqIDM
• https://groups.google.com/forum/#!topic/django-announce/zFCMdgUnutU
• https://www.openwall.com/lists/oss-security/2020/09/01/2
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://github.com/django/django/commit/2b099caa5923afa8cfb5f1e8c0d56b6e0e81915b
• https://github.com/django/django/commit/a3aebfdc8153dc230686b6d2454ccd32ed4c9e6f
• https://github.com/django/django/commit/cdb367c92a0ba72ddc0cbd13ff42b0e6df709554
• https://docs.djangoproject.com/en/dev/releases/security
• https://lists.fedoraproject.org/archives/list/[email protected]/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU
• https://lists.fedoraproject.org/archives/list/[email protected]/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T
• https://lists.fedoraproject.org/archives/list/[email protected]/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI
• https://security.netapp.com/advisory/ntap-20200918-0004
• https://usn.ubuntu.com/4479-1
• https://www.djangoproject.com/weblog/2020/sep/01/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-34.yaml
• https://github.com/advisories/GHSA-fr28-569j-53c4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Directory Traversal via archive.extract

CVE-2021-3281 / GHSA-fvgf-6h6h-3322

More information

Details

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-3281
• https://github.com/django/django/commit/05413afa8c18cdb978fcdf470e09f7a12b234a23
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/02e6592835b4559909aa3aaaf67988fef435f624
• https://github.com/django/django/commit/21e7622dec1f8612c85c2fc37fe8efbfd3311e37
• https://github.com/django/django/commit/52e409ed17287e9aabda847b6afe58be2fa9f86a
• https://docs.djangoproject.com/en/3.1/releases/3.0.12
• https://docs.djangoproject.com/en/3.1/releases/security
• https://github.com/advisories/GHSA-fvgf-6h6h-3322
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-9.yaml
• https://lists.fedoraproject.org/archives/list/[email protected]/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO
• https://security.netapp.com/advisory/ntap-20210226-0004
• https://www.djangoproject.com/weblog/2021/feb/01/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to Reflected File Download attack

CVE-2022-36359 / GHSA-8x94-hmjh-97hq

More information

Details

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-36359
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml
• https://groups.google.com/g/django-announce/c/8cz--gvaJr4
• http://www.openwall.com/lists/oss-security/2022/08/03/1
• https://www.debian.org/security/2022/dsa-5254
• https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b80
• https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb3
• https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/[email protected]/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/[email protected]/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://security.netapp.com/advisory/ntap-20220915-0008
• https://www.djangoproject.com/weblog/2022/aug/03/security-releases
• https://github.com/advisories/GHSA-8x94-hmjh-97hq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Incorrect Default Permissions

CVE-2020-24583 / GHSA-m6gj-h9gm-gw44

More information

Details

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-24583
• https://github.com/django/django/commit/8d7271578d7b153435b40fe40236ebec43cbf1b9
• https://groups.google.com/forum/#!topic/django-announce/Gdqn58RqIDM
• https://groups.google.com/forum/#!topic/django-announce/zFCMdgUnutU
• https://www.openwall.com/lists/oss-security/2020/09/01/2
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/advisories/GHSA-m6gj-h9gm-gw44
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-33.yaml
• https://lists.fedoraproject.org/archives/list/[email protected]/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU
• https://lists.fedoraproject.org/archives/list/[email protected]/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T
• https://lists.fedoraproject.org/archives/list/[email protected]/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI
• https://security.netapp.com/advisory/ntap-20200918-0004
• https://usn.ubuntu.com/4479-1
• https://www.djangoproject.com/weblog/2020/sep/01/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

SQL Injection in Django

CVE-2021-35042 / GHSA-xpfp-f569-q3p2

More information

Details

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-35042
• https://groups.google.com/forum/#!forum/django-announce
• https://www.openwall.com/lists/oss-security/2021/07/02/2
• https://github.com/django/django/commit/0bd57a879a0d54920bb9038a732645fb917040e9
• https://github.com/django/django/commit/a34a5f724c5d5adb2109374ba3989ebb7b11f81f
• https://github.com/django/django/commit/dae83a24519d6f284c74414e0b81d64d9b5a0db4
• https://docs.djangoproject.com/en/3.2/releases/security
• https://lists.fedoraproject.org/archives/list/[email protected]/message/SS6NJTBYWOX6J7G4U3LUOILARJKWPQ5Y
• https://security.netapp.com/advisory/ntap-20210805-0008
• https://www.djangoproject.com/weblog/2021/jul/01/security-releases
• https://github.com/advisories/GHSA-xpfp-f569-q3p2
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-109.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Path Traversal in Django

CVE-2021-31542 / GHSA-rxjp-mfm9-w4wr

More information

Details

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-31542
• https://groups.google.com/forum/#!forum/django-announce
• https://lists.debian.org/debian-lts-announce/2021/05/msg00005.html
• http://www.openwall.com/lists/oss-security/2021/05/04/3
• https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d
• https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48
• https://github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007
• https://groups.google.com/forum/#%21forum/django-announce
• https://docs.djangoproject.com/en/3.2/releases/security
• https://github.com/advisories/GHSA-rxjp-mfm9-w4wr
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-7.yaml
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE
• https://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
• https://lists.fedoraproject.org/archives/list/[email protected]/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE
• https://security.netapp.com/advisory/ntap-20210618-0001
• https://www.djangoproject.com/weblog/2021/may/04/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Path Traversal in Django

CVE-2021-33203 / GHSA-68w8-qjq3-2gfm

More information

Details

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-33203
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/053cc9534d174dc89daba36724ed2dcb36755b90
• https://github.com/django/django/commit/20c67a0693c4ede2b09af02574823485e82e4c8f
• https://github.com/django/django/commit/dfaba12cda060b8b292ae1d271b44bf810b1c5b9
• https://docs.djangoproject.com/en/3.2/releases/security
• https://github.com/advisories/GHSA-68w8-qjq3-2gfm
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-98.yaml
• https://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
• https://security.netapp.com/advisory/ntap-20210727-0004
• https://www.djangoproject.com/weblog/2021/jun/02/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Potential bypass of an upstream access control based on URL paths in Django

CVE-2021-44420 / GHSA-v6rh-hp5x-86rv

More information

Details

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. This issue has low severity, according to the Django security policy.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-44420
• https://groups.google.com/forum/#!forum/django-announce
• https://www.openwall.com/lists/oss-security/2021/12/07/1
• https://github.com/django/django/commit/d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6
• https://docs.djangoproject.com/en/3.2/releases/security
• https://github.com/advisories/GHSA-v6rh-hp5x-86rv
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-439.yaml
• https://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
• https://security.netapp.com/advisory/ntap-20211229-0006
• https://www.djangoproject.com/weblog/2021/dec/07/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Directory Traversal in Django

CVE-2021-28658 / GHSA-xgxc-v2qg-chmh

More information

Details

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-28658
• https://groups.google.com/g/django-announce/c/ePr5j-ngdPU
• https://lists.debian.org/debian-lts-announce/2021/04/msg00008.html
• https://docs.djangoproject.com/en/3.1/releases/security
• https://github.com/advisories/GHSA-xgxc-v2qg-chmh
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-6.yaml
• https://lists.fedoraproject.org/archives/list/[email protected]/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE
• https://pypi.org/project/Django
• https://security.netapp.com/advisory/ntap-20210528-0001
• https://www.djangoproject.com/weblog/2021/apr/06/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks

CVE-2021-33571 / GHSA-p99v-5w3c-jqq9

More information

Details

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-33571
• https://groups.google.com/g/django-announce/c/sPyjSKMi8Eo
• https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e
• https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d
• https://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fc
• https://docs.djangoproject.com/en/3.2/releases/security
• https://github.com/advisories/GHSA-p99v-5w3c-jqq9
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-99.yaml
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
• https://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
• https://security.netapp.com/advisory/ntap-20210727-0004
• https://www.djangoproject.com/weblog/2021/jun/02/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django allows enumeration of user e-mail addresses

CVE-2024-45231 / GHSA-rrqc-c2jx-6jgv

More information

Details

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-45231
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/sep/03/security-releases
• https://github.com/django/django/commit/3c733c78d6f8e50296d6e248968b6516c92a53ca
• https://github.com/django/django/commit/96d84047715ea1715b4bd1594e46122b8a77b9e2
• https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199
• https://github.com/advisories/GHSA-rrqc-c2jx-6jgv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Improper Output Neutralization for Logs vulnerability

CVE-2025-48432 / GHSA-7xr5-9hcq-chf9

More information

Details

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-48432
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/jun/04/security-releases
• http://www.openwall.com/lists/oss-security/2025/06/04/5
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-47.yaml
• https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases
• http://www.openwall.com/lists/oss-security/2025/06/10/2
• http://www.openwall.com/lists/oss-security/2025/06/10/3
• http://www.openwall.com/lists/oss-security/2025/06/10/4
• https://github.com/advisories/GHSA-7xr5-9hcq-chf9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django is subject to SQL injection through its column aliases

CVE-2025-57833 / GHSA-6w2r-r2m5-xq5w

More information

Details

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-57833
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://medium.com/@​EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898
• https://www.djangoproject.com/weblog/2025/sep/03/security-releases
• https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5
• https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92
• https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243
• https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html
• http://www.openwall.com/lists/oss-security/2025/09/03/3
• https://github.com/advisories/GHSA-6w2r-r2m5-xq5w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

CVE-2025-64459 / GHSA-frmv-pr5f-9mcr

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64459
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
• https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
• https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
• https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
• https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html
• https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed
• https://github.com/advisories/GHSA-frmv-pr5f-9mcr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

CVE-2025-64458 / GHSA-qw25-v68c-qjf3

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64458
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
• https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
• https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
• https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
• https://github.com/advisories/GHSA-qw25-v68c-qjf3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

django/django (Django)

v4.2.26

Compare Source

v4.2.25

Compare Source

v4.2.24

Compare Source

v4.2.23

Compare Source

v4.2.22

Compare Source

v4.2.21

Compare Source

v4.2.20

Compare Source

v4.2.19

Compare Source

v4.2.18

Compare Source

v4.2.17

Compare Source

v4.2.16

Compare Source

v4.2.15

Compare Source

v4.2.14

Compare Source

v4.2.13

Compare Source

v4.2.12

Compare Source

v4.2.11

Compare Source

v4.2.10

Compare Source

v4.2.9

Compare Source

v4.2.8

Compare Source

v4.2.7

Compare Source

v4.2.6

Compare Source

v4.2.5

Compare Source

v4.2.4

Compare Source

v4.2.3

Compare Source

v4.2.2

Compare Source

v4.2.1

Compare Source

v4.2

Compare Source

v4.1.13

Compare Source

v4.1.12

Compare Source

v4.1.11

Compare Source

v4.1.10

Compare Source

v4.1.9

Compare Source

v4.1.8

Compare Source

v4.1.7

Compare Source

v4.1.6

Compare Source

v4.1.5

Compare Source

v4.1.4

Compare Source

v4.1.3

Compare Source

v4.1.2

Compare Source

v4.1.1

Compare Source

v4.1

Compare Source

v4.0.10

Compare Source

v4.0.9

Compare Source

v4.0.8

Compare Source

v4.0.7

Compare Source

v4.0.6

Compare Source

v4.0.5

Compare Source

v4.0.4

Compare Source

v4.0.3

Compare Source

v4.0.2

Compare Source

v4.0.1

Compare Source

v4.0

Compare Source

v3.2.25

Compare Source

v3.2.24

Compare Source

v3.2.23

Compare Source

v3.2.22

Compare Source

v3.2.21

Compare Source

v3.2.20

Compare Source

v3.2.19

Compare Source

v3.2.18

Compare Source

v3.2.17

Compare Source

v3.2.16

Compare Source

v3.2.15

Compare Source

v3.2.14

Compare Source

v3.2.13

Compare Source

v3.2.12

Compare Source

v3.2.11

Compare Source

v3.2.10

Compare Source

v3.2.9

Compare Source

v3.2.8

Compare Source

v3.2.7

Compare Source

v3.2.6

Compare Source

v3.2.5

Compare Source

v3.2.4

Compare Source

v3.2.3

Compare Source

v3.2.2

Compare Source

v3.2.1

Compare Source

v3.2

Compare Source

v3.1.14

Compare Source

v3.1.13

Compare Source

v3.1.12

Compare Source

v3.1.11

Compare Source

v3.1.10

Compare Source

v3.1.9

Compare Source

v3.1.8

Compare Source

v3.1.7

Compare Source

v3.1.6

Compare Source

v3.1.5

Compare Source

v3.1.4

Compare Source

[v3.1.3](https://redirect.github.com/dj

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud