CVE-2026-87890

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank sicksec for reporting this issue.

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank sicksec for reporting this issue.

Potential denial-of-service vulnerability in get_supported_language_variant(). (CVE-2026-77050) Potential denial-of-service vulnerability in HTTP header parsing. (CVE-2026-84429) Potential request forgery via spatial lookup byte values. (CVE-2026-87890) Privilege abuse in model formsets with editable primary keys. (CVE-2026-87975)

These are all security issues fixed in the python313-Django4-4.2.30-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.18-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django-6.1.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-Django fixes the following issues:

Changes in python-Django:

• CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting queryset, without any permission on the targeted object, marking an out-of-queryset object for deletion (bsc#1284471)
• CVE-2026-87890: An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to cause the Django process to make network requests via a crafted VRT document (bsc#1284472)
• CVE-2026-84429: potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter (bsc#1284476)
• CVE-2026-77050: potential denial-of-service in get_supported_language_variant() when processing many distinct, very long language codes (bsc#1284481)

This update for python-Django fixes the following issues:

• CVE-2026-77050: potential denial-of-service in get_supported_language_variant() when processing many distinct, very long language codes (bsc#1284481).
• CVE-2026-84429: potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter (bsc#1284476).
• CVE-2026-87890: An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to cause the Django process to make network requests via a crafted VRT document (bsc#1284472).
• CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting queryset, without any permission on the targeted object, marking an out-of-queryset object for deletion (bsc#1284471).