CVE-2025-26699
Django Vulnerable to Allocation of Resources Without Limits or Throttling
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
CVE-2025-26699- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2025-6773
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
EUVD-2025-6773- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p3fp-8748-vqfq
Django Vulnerable to Allocation of Resources Without Limits or Throttling
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
GHSA-p3fp-8748-vqfq- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-04
NVD
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
CVE-2025-26699- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-26699
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
ALPINE-CVE-2025-26699- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
CVE-2025-26699- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 24 moreShow less
OSVDEBIAN-CVE-2025-26699
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
DEBIAN-CVE-2025-26699- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-p3fp-8748-vqfq
Django Vulnerable to Allocation of Resources Without Limits or Throttling
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
GHSA-p3fp-8748-vqfq- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-04
OSVOESA-2025-1260
python-django security update
A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
Security Fix(es):
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.(CVE-2025-26699)
- Record
OESA-2025-1260- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2025:3160
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2025:3160- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:4553
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2025:4553- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:8609
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Record
RHSA-2025:8609- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-26699
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
UBUNTU-CVE-2025-26699- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-django-2025-26699 No score
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
BIT-django-2025-26699- Updated
- 2026-11-02
OSVCLSA-2026-1788169795 No score
TuxCare security update for django (11 CVEs)
TuxCare rebuilt django to address 11 CVEs. Fixed in 5.0.2.post6+tuxcare.
- Record
CLSA-2026-1788169795- Updated
- 2026-11-02
OSVCLSA-2026-1788171127 No score
TuxCare security update for django (4 CVEs)
TuxCare rebuilt django to address 4 CVEs. Fixed in 5.1.4.post4+tuxcare.
- Record
CLSA-2026-1788171127- Updated
- 2026-11-02
OSVCLSA-2026-1789454744 No score
TuxCare security update for django (5 CVEs)
TuxCare rebuilt django to address 5 CVEs. Fixed in 5.0.1.post9+tuxcare.
- Record
CLSA-2026-1789454744- Updated
- 2026-11-02
OSVCLSA-2026-1789455474 No score
TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.post12+tuxcare.
- Record
CLSA-2026-1789455474- Updated
- 2026-11-02
OSVCLSA-2026-1789538853 No score
TuxCare security update for django (3 CVEs)
TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.post10+tuxcare.
- Record
CLSA-2026-1789538853- Updated
- 2026-11-02
OSVCLSA-2026-1792393048 No score
TuxCare security update for django (20 CVEs)
TuxCare rebuilt django to address 20 CVEs. Fixed in 4.2.post17+tuxcare.
- Record
CLSA-2026-1792393048- Updated
- 2026-11-02
OSVCLSA-2026-1793695934 No score
TuxCare security update for django (6 CVEs)
TuxCare rebuilt django to address 6 CVEs. Fixed in 4.0.post27+tuxcare.
- Record
CLSA-2026-1793695934- Updated
- 2026-11-03
OSVCLSA-2026-1793869737 No score
TuxCare security update for django (6 CVEs)
TuxCare rebuilt django to address 6 CVEs. Fixed in 3.2.25.post16+tuxcare.
- Record
CLSA-2026-1793869737- Updated
- 2026-11-05
OSVMGASA-2025-0095 No score
Updated python-django packages fix security vulnerability
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings. (CVE-2025-26699)
- Record
MGASA-2025-0095- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14908-1 No score
python311-Django4-4.2.20-1.1 on GA media
These are all security issues fixed in the python311-Django4-4.2.20-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14908-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14913-1 No score
python311-Django-5.1.7-1.1 on GA media
These are all security issues fixed in the python311-Django-5.1.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14913-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10005-1 No score
python312-Django6-6.0-1.1 on GA media
These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10005-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11270-1 No score
python313-Django5-5.2.16-1.1 on GA media
These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11270-1- Updated
- 2026-11-02
OSVPYSEC-2025-13 No score
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
- Record
PYSEC-2025-13- Updated
- 2026-11-02
OSVSUSE-SU-2025:0959-1 No score
Security update for python-Django
This update for python-Django fixes the following issues:
- CVE-2025-26699: Fixed potential denial-of-service in django.utils.text.wrap() (bsc#1239052).
- Record
SUSE-SU-2025:0959-1- Updated
- 2026-11-02
OSVUSN-7335-1 No score
python-django vulnerability
It was discovered that Django incorrectly handled text wrapping. An attacker could possibly use this issue to cause a denial of service.
- Record
USN-7335-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
4.2 up to 4.2.20 | 4.2.20 |
djangoPyPI |
5.0 up to 5.0.13 | 5.0.13 |
djangoPyPI |
5.1 up to 5.1.7 | 5.1.7 |
py3-djangoAlpine:v3.21 |
before 4.2.20-r0 | 4.2.20-r0 |
py3-djangoAlpine:v3.22 |
before 4.2.20-r0 | 4.2.20-r0 |
py3-djangoAlpine:v3.23 |
before 4.2.20-r0 | 4.2.20-r0 |
py3-djangoAlpine:v3.24 |
before 4.2.20-r0 | 4.2.20-r0 |
djangoBitnami |
4.2.0 up to 5.1.7 | 5.1.7 |
djangoTuxCare:PyPI From an advisory covering 11 CVEs |
5.0.2 up to 5.0.2.post6+tuxcare, plus listed versions 5.0.2.post1+tuxcare5.0.2.post2+tuxcare5.0.2.post3+tuxcare5.0.2.post4+tuxcare5.0.2.post5+tuxcare |
5.0.2.post6+tuxcare |
djangoTuxCare:PyPI From an advisory covering 4 CVEs |
5.1.4 up to 5.1.4.post4+tuxcare, plus listed versions 5.1.4.post1+tuxcare5.1.4.post2+tuxcare5.1.4.post3+tuxcare |
5.1.4.post4+tuxcare |
Show 52 moreShow less
| Package | Affected | Fixed |
|---|---|---|
djangoTuxCare:PyPI From an advisory covering 5 CVEs |
5.0.1 up to 5.0.1.post9+tuxcare, plus listed versions 5.0.1.post1+tuxcare5.0.1.post2+tuxcare5.0.1.post3+tuxcare5.0.1.post4+tuxcare5.0.1.post5+tuxcare5.0.1.post6+tuxcare5.0.1.post7+tuxcare5.0.1.post8+tuxcare |
5.0.1.post9+tuxcare |
djangoTuxCare:PyPI From an advisory covering 2 CVEs |
5.0 up to 5.0.post12+tuxcare, plus listed versions 5.0.post1+tuxcare5.0.post10+tuxcare5.0.post11+tuxcare5.0.post2+tuxcare5.0.post3+tuxcare Show 6 moreShow less5.0.post4+tuxcare5.0.post5+tuxcare5.0.post6+tuxcare5.0.post7+tuxcare5.0.post8+tuxcare5.0.post9+tuxcare |
5.0.post12+tuxcare |
djangoTuxCare:PyPI From an advisory covering 3 CVEs |
5.1 up to 5.1.post10+tuxcare, plus listed versions 5.1.post1+tuxcare5.1.post2+tuxcare5.1.post3+tuxcare5.1.post4+tuxcare5.1.post5+tuxcare Show 4 moreShow less5.1.post6+tuxcare5.1.post7+tuxcare5.1.post8+tuxcare5.1.post9+tuxcare |
5.1.post10+tuxcare |
djangoTuxCare:PyPI From an advisory covering 20 CVEs |
4.2 up to 4.2.post17+tuxcare, plus listed versions 4.2.post1+tuxcare4.2.post10+tuxcare4.2.post11+tuxcare4.2.post12+tuxcare4.2.post13+tuxcare Show 11 moreShow less4.2.post14+tuxcare4.2.post15+tuxcare4.2.post16+tuxcare4.2.post2+tuxcare4.2.post3+tuxcare4.2.post4+tuxcare4.2.post5+tuxcare4.2.post6+tuxcare4.2.post7+tuxcare4.2.post8+tuxcare4.2.post9+tuxcare |
4.2.post17+tuxcare |
djangoTuxCare:PyPI From an advisory covering 6 CVEs |
4.0 up to 4.0.post27+tuxcare, plus listed versions 4.0.post1+tuxcare4.0.post10+tuxcare4.0.post11+tuxcare4.0.post12+tuxcare4.0.post13+tuxcare Show 21 moreShow less4.0.post14+tuxcare4.0.post15+tuxcare4.0.post16+tuxcare4.0.post17+tuxcare4.0.post18+tuxcare4.0.post19+tuxcare4.0.post2+tuxcare4.0.post20+tuxcare4.0.post21+tuxcare4.0.post22+tuxcare4.0.post23+tuxcare4.0.post24+tuxcare4.0.post25+tuxcare4.0.post26+tuxcare4.0.post3+tuxcare4.0.post4+tuxcare4.0.post5+tuxcare4.0.post6+tuxcare4.0.post7+tuxcare4.0.post8+tuxcare4.0.post9+tuxcare |
4.0.post27+tuxcare |
djangoTuxCare:PyPI From an advisory covering 6 CVEs |
3.2.25 up to 3.2.25.post16+tuxcare, plus listed versions 3.2.25.post1+tuxcare3.2.25.post10+tuxcare3.2.25.post11+tuxcare3.2.25.post12+tuxcare3.2.25.post13+tuxcare Show 10 moreShow less3.2.25.post14+tuxcare3.2.25.post15+tuxcare3.2.25.post2+tuxcare3.2.25.post3+tuxcare3.2.25.post4+tuxcare3.2.25.post5+tuxcare3.2.25.post6+tuxcare3.2.25.post7+tuxcare3.2.25.post8+tuxcare3.2.25.post9+tuxcare |
3.2.25.post16+tuxcare |
python-djangoDebian:12 |
before 3:3.2.25-0+deb12u1, plus listed versions 3:3.2.19-13:3.2.19-1+deb12u13:3.2.19-1+deb12u1~bpo11+13:3.2.19-1+deb12u23:3.2.20-13:3.2.20-1.13:3.2.21-1 |
3:3.2.25-0+deb12u1 |
python-djangoDebian:13 |
before 3:4.2.20-1 | 3:4.2.20-1 |
python-djangoDebian:14 |
before 3:4.2.20-1 | 3:4.2.20-1 |
python-djangoDebian:11 |
before 2:2.2.28-1~deb11u6, plus listed versions 2:2.2.24-12:2.2.25-1~deb11u12:2.2.26-1~deb11u12:2.2.28-1~deb11u12:2.2.28-1~deb11u22:2.2.28-1~deb11u32:2.2.28-1~deb11u42:2.2.28-1~deb11u5 |
2:2.2.28-1~deb11u6 |
python-djangoDebian:12 From an advisory covering 23 CVEs |
before 3:3.2.25-0+deb12u1, plus listed versions 3:3.2.19-13:3.2.19-1+deb12u13:3.2.19-1+deb12u1~bpo11+13:3.2.19-1+deb12u23:3.2.20-13:3.2.20-1.13:3.2.21-1 |
3:3.2.25-0+deb12u1 |
djangoPyPI |
4.2 up to 4.2.20, plus listed versions 4.2.14.2.104.2.114.2.124.2.13 Show 14 moreShow less4.2.144.2.154.2.164.2.174.2.184.2.194.2.24.2.34.2.44.2.54.2.64.2.74.2.84.2.9 |
4.2.20 |
djangoPyPI |
5.0 up to 5.0.13, plus listed versions 5.0.15.0.105.0.115.0.125.0.2 Show 7 moreShow less5.0.35.0.45.0.55.0.65.0.75.0.85.0.9 |
5.0.13 |
djangoPyPI |
5.1 up to 5.1.7, plus listed versions 5.1.15.1.25.1.35.1.45.1.55.1.6 |
5.1.7 |
python-djangoMageia:9 |
before 4.1.13-1.3.mga9 | 4.1.13-1.3.mga9 |
python-djangoopenEuler:24.03-LTS-SP1 |
before 4.2.15-5.oe2403sp1 | 4.2.15-5.oe2403sp1 |
python-djangoopenEuler:20.03-LTS-SP4 |
before 2.2.27-15.oe2003sp4 | 2.2.27-15.oe2003sp4 |
python-djangoopenEuler:22.03-LTS-SP3 |
before 4.2.15-5.oe2203sp3 | 4.2.15-5.oe2203sp3 |
python-djangoopenEuler:22.03-LTS-SP4 |
before 4.2.15-5.oe2203sp4 | 4.2.15-5.oe2203sp4 |
python-djangoopenEuler:24.03-LTS |
before 4.2.15-5.oe2403 | 4.2.15-5.oe2403 |
djangoPyPI |
5.1 up to 5.1.7, 5.0 up to 5.0.13, 4.2 up to 4.2.20, plus listed versions 4.2.14.2.104.2.114.2.124.2.13 Show 32 moreShow less4.2.144.2.154.2.164.2.174.2.184.2.194.2.24.2.34.2.44.2.54.2.64.2.74.2.84.2.95.0.15.0.105.0.115.0.125.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.95.1.15.1.25.1.35.1.45.1.55.1.6 |
5.1.75.0.134.2.20 |
python3.11-djangoRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 2 CVEs |
before 0:4.2.20-1.el8ap | 0:4.2.20-1.el8ap |
python3.11-djangoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 2 CVEs |
before 0:4.2.20-1.el8ap | 0:4.2.20-1.el8ap |
python3.11-djangoRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 2 CVEs |
before 0:4.2.20-1.el9ap | 0:4.2.20-1.el9ap |
python3.11-djangoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 2 CVEs |
before 0:4.2.20-1.el9ap | 0:4.2.20-1.el9ap |
python3.11-jinja2Red Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 2 CVEs |
before 0:3.1.6-1.el8ap | 0:3.1.6-1.el8ap |
python3.11-jinja2Red Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 2 CVEs |
before 0:3.1.6-1.el8ap | 0:3.1.6-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 2 CVEs |
before 0:4.6.10-1.el8ap | 0:4.6.10-1.el8ap |
python3.11-jinja2Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 2 CVEs |
before 0:3.1.6-1.el8ap | 0:3.1.6-1.el8ap |
python3.11-jinja2Red Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 2 CVEs |
before 0:3.1.6-1.el9ap | 0:3.1.6-1.el9ap |
python3.11-jinja2Red Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 2 CVEs |
before 0:3.1.6-1.el9ap | 0:3.1.6-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 2 CVEs |
before 0:4.6.10-1.el9ap | 0:4.6.10-1.el9ap |
python3.11-jinja2Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 2 CVEs |
before 0:3.1.6-1.el9ap | 0:3.1.6-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 |
before 0:4.6.12-1.el8ap | 0:4.6.12-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 |
before 0:4.6.12-1.el9ap | 0:4.6.12-1.el9ap |
python39-djangoRed Hat:ansible_automation_platform:2.4::el8 |
before 0:4.2.21-1.el8ap | 0:4.2.21-1.el8ap |
python3x-djangoRed Hat:ansible_automation_platform:2.4::el8 |
before 0:4.2.21-1.el8ap | 0:4.2.21-1.el8ap |
python-djangoRed Hat:ansible_automation_platform:2.4::el9 |
before 0:4.2.21-1.el9ap | 0:4.2.21-1.el9ap |
python3-djangoRed Hat:ansible_automation_platform:2.4::el9 |
before 0:4.2.21-1.el9ap | 0:4.2.21-1.el9ap |
python-DjangoSUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 4.2.11-150600.3.18.1 | 4.2.11-150600.3.18.1 |
python-DjangoopenSUSE:Leap 15.6 |
before 4.2.11-150600.3.18.1 | 4.2.11-150600.3.18.1 |
python-djangoUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.5.4-1ubuntu11.6-11.6.1-11.6.1-21.6.1-2ubuntu0.1 Show 30 moreShow less1.6.1-2ubuntu0.21.6.1-2ubuntu0.31.6.1-2ubuntu0.41.6.1-2ubuntu0.51.6.1-2ubuntu0.61.6.1-2ubuntu0.81.6.1-2ubuntu0.91.6.1-2ubuntu0.101.6.1-2ubuntu0.111.6.1-2ubuntu0.121.6.1-2ubuntu0.131.6.1-2ubuntu0.141.6.1-2ubuntu0.151.6.1-2ubuntu0.161.6.11-0ubuntu11.6.11-0ubuntu1.11.6.11-0ubuntu1.21.6.11-0ubuntu1.31.6.11-0ubuntu1.3+esm11.6.11-0ubuntu1.3+esm21.6.11-0ubuntu1.3+esm31.6.11-0ubuntu1.3+esm41.6.11-0ubuntu1.3+esm51.6.11-0ubuntu1.3+esm61.6.11-0ubuntu1.3+esm71.6.11-0ubuntu1.3+esm81.6.11-0ubuntu1.3+esm91.6.11-0ubuntu1.3+esm101.6.11-0ubuntu1.3+esm111.6.11-0ubuntu1.3+esm12 |
None known |
python-djangoUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.7.9-1ubuntu51.8.5-2ubuntu11.8.7-1ubuntu11.8.7-1ubuntu21.8.7-1ubuntu3 Show 28 moreShow less1.8.7-1ubuntu41.8.7-1ubuntu51.8.7-1ubuntu5.11.8.7-1ubuntu5.21.8.7-1ubuntu5.41.8.7-1ubuntu5.51.8.7-1ubuntu5.61.8.7-1ubuntu5.71.8.7-1ubuntu5.81.8.7-1ubuntu5.91.8.7-1ubuntu5.101.8.7-1ubuntu5.111.8.7-1ubuntu5.121.8.7-1ubuntu5.131.8.7-1ubuntu5.141.8.7-1ubuntu5.151.8.7-1ubuntu5.15+esm11.8.7-1ubuntu5.15+esm31.8.7-1ubuntu5.15+esm41.8.7-1ubuntu5.15+esm51.8.7-1ubuntu5.15+esm61.8.7-1ubuntu5.15+esm71.8.7-1ubuntu5.15+esm81.8.7-1ubuntu5.15+esm91.8.7-1ubuntu5.15+esm101.8.7-1ubuntu5.15+esm111.8.7-1ubuntu5.15+esm121.8.7-1ubuntu5.15+esm13 |
None known |
python-djangoUbuntu:Pro:18.04:LTS |
before 1:1.11.11-1ubuntu1.21+esm10, plus listed versions 1:1.11.4-1ubuntu11:1.11.6-1ubuntu11:1.11.9-1ubuntu11:1.11.11-1ubuntu11:1.11.11-1ubuntu1.1 Show 29 moreShow less1:1.11.11-1ubuntu1.21:1.11.11-1ubuntu1.31:1.11.11-1ubuntu1.41:1.11.11-1ubuntu1.51:1.11.11-1ubuntu1.61:1.11.11-1ubuntu1.71:1.11.11-1ubuntu1.81:1.11.11-1ubuntu1.91:1.11.11-1ubuntu1.101:1.11.11-1ubuntu1.111:1.11.11-1ubuntu1.121:1.11.11-1ubuntu1.131:1.11.11-1ubuntu1.141:1.11.11-1ubuntu1.151:1.11.11-1ubuntu1.161:1.11.11-1ubuntu1.171:1.11.11-1ubuntu1.181:1.11.11-1ubuntu1.191:1.11.11-1ubuntu1.201:1.11.11-1ubuntu1.211:1.11.11-1ubuntu1.21+esm11:1.11.11-1ubuntu1.21+esm21:1.11.11-1ubuntu1.21+esm31:1.11.11-1ubuntu1.21+esm41:1.11.11-1ubuntu1.21+esm51:1.11.11-1ubuntu1.21+esm61:1.11.11-1ubuntu1.21+esm71:1.11.11-1ubuntu1.21+esm81:1.11.11-1ubuntu1.21+esm9 |
1:1.11.11-1ubuntu1.21+esm10 |
python-djangoUbuntu:20.04:LTS |
before 2:2.2.12-1ubuntu0.28, plus listed versions 1:1.11.22-1ubuntu12:2.2.6-1ubuntu12:2.2.9-2ubuntu12:2.2.10-12:2.2.10-1ubuntu1 Show 29 moreShow less2:2.2.11-12:2.2.12-12:2.2.12-1ubuntu0.12:2.2.12-1ubuntu0.22:2.2.12-1ubuntu0.32:2.2.12-1ubuntu0.42:2.2.12-1ubuntu0.52:2.2.12-1ubuntu0.62:2.2.12-1ubuntu0.72:2.2.12-1ubuntu0.82:2.2.12-1ubuntu0.92:2.2.12-1ubuntu0.102:2.2.12-1ubuntu0.112:2.2.12-1ubuntu0.122:2.2.12-1ubuntu0.132:2.2.12-1ubuntu0.142:2.2.12-1ubuntu0.152:2.2.12-1ubuntu0.162:2.2.12-1ubuntu0.172:2.2.12-1ubuntu0.182:2.2.12-1ubuntu0.192:2.2.12-1ubuntu0.202:2.2.12-1ubuntu0.212:2.2.12-1ubuntu0.222:2.2.12-1ubuntu0.232:2.2.12-1ubuntu0.242:2.2.12-1ubuntu0.252:2.2.12-1ubuntu0.262:2.2.12-1ubuntu0.27 |
2:2.2.12-1ubuntu0.28 |
python-djangoUbuntu:22.04:LTS |
before 2:3.2.12-2ubuntu1.17, plus listed versions 2:2.2.24-1ubuntu12:3.2.12-22:3.2.12-2ubuntu12:3.2.12-2ubuntu1.12:3.2.12-2ubuntu1.2 Show 14 moreShow less2:3.2.12-2ubuntu1.32:3.2.12-2ubuntu1.42:3.2.12-2ubuntu1.52:3.2.12-2ubuntu1.62:3.2.12-2ubuntu1.72:3.2.12-2ubuntu1.82:3.2.12-2ubuntu1.92:3.2.12-2ubuntu1.102:3.2.12-2ubuntu1.112:3.2.12-2ubuntu1.122:3.2.12-2ubuntu1.132:3.2.12-2ubuntu1.142:3.2.12-2ubuntu1.152:3.2.12-2ubuntu1.16 |
2:3.2.12-2ubuntu1.17 |
python-djangoUbuntu:24.04:LTS |
before 3:4.2.11-1ubuntu1.6, plus listed versions 3:4.2.4-1ubuntu23:4.2.8-13:4.2.9-13:4.2.11-13:4.2.11-1ubuntu1 Show 5 moreShow less3:4.2.11-1ubuntu1.13:4.2.11-1ubuntu1.23:4.2.11-1ubuntu1.33:4.2.11-1ubuntu1.43:4.2.11-1ubuntu1.5 |
3:4.2.11-1ubuntu1.6 |
python-djangoUbuntu:25.10 |
before 3:4.2.18-1ubuntu1 | 3:4.2.18-1ubuntu1 |
python-Django4openSUSE:Tumbleweed |
before 4.2.20-1.1 | 4.2.20-1.1 |
python-DjangoopenSUSE:Tumbleweed |
before 5.1.7-1.1 | 5.1.7-1.1 |
python-Django6openSUSE:Tumbleweed From an advisory covering 70 CVEs |
before 6.0-1.1 | 6.0-1.1 |
python-Django5openSUSE:Tumbleweed From an advisory covering 93 CVEs |
before 5.2.16-1.1 | 5.2.16-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases | OSV | |
| references | OSV | |
| facts, references, title | GitHub Advisories | |
| affected, aliases | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-26699 is a medium vulnerability (CVSS 5.0) in Djangoproject Django, published March 6, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in django 4.2.20.
References
docs.djangoproject.com/en/dev/releases/security
groups.google.com/g/django-announce
djangoproject.com/weblog/2025/mar/06/security-releases
openwall.com/lists/oss-security/2025/03/06/12
lists.debian.org/debian-lts-announce/2025/03/msg00012.html
nvd.nist.gov/vuln/detail/CVE-2025-26699
Show 127 moreShow less
github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-13.yaml
security.alpinelinux.org/vuln/CVE-2025-26699
security-tracker.debian.org/tracker/CVE-2025-26699
advisories.mageia.org/MGASA-2025-0095.html
bugs.mageia.org/show_bug.cgi?id=34073
ubuntu.com/security/notices/USN-7335-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1260
access.redhat.com/errata/RHSA-2025:3160
bugzilla.redhat.com/show_bug.cgi?id=2348993
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3160.json
cve.org/CVERecord?id=CVE-2025-26699
suse.com/support/update/announcement/2025/suse-su-20250959-1
bugzilla.suse.com/1239052
lists.opensuse.org/archives/list/[email protected]/thread/4UUR6QLJ2MA72XQAMNLLETDIRMW3LSOH