CVE-2026-114582
Server-side request forgery via SpatialReference string input
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Adraca for reporting this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Server-side request forgery via SpatialReference string input
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Adraca for reporting this issue.
- Record
CVE-2026-114582- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-03
EUVDEUVD-2026-116023
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Adraca for reporting this issue.
- Record
EUVD-2026-116023- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c37w-4pqp-2hm7
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. ...
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Adraca for reporting this issue.
- Record
GHSA-c37w-4pqp-2hm7- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-03
NVD
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Adraca for reporting this issue.
- Record
CVE-2026-114582- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-03
OSVALPINE-CVE-2026-114582
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Adraca for reporting this issue.
- Record
ALPINE-CVE-2026-114582- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-04
OSV
Server-side request forgery via SpatialReference string input
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Adraca for reporting this issue.
- Record
CVE-2026-114582- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-09
Show 6 moreShow less
OSVDEBIAN-CVE-2026-114582
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Adraca for reporting this issue.
- Record
DEBIAN-CVE-2026-114582- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-09
OSVUBUNTU-CVE-2026-114582
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Adraca for reporting this issue.
- Record
UBUNTU-CVE-2026-114582- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-05
OSVMGASA-2026-0591No score
Updated python-django package fixes security vulnerabilities
CVE-2026-108147: Potential memory exhaustion in MultiPartParser via
base64-encoded file upload
CVE-2026-111211: Potential log injection via unescaped geometry form
values
CVE-2026-111362: Server-side request forgery via crs member of GeoJSON
geometries
CVE-2026-113593: Potential exposure of private data via empty and
missing Vary headers
CVE-2026-113733: Password hash disclosure to "view only" admin users
with custom user models
CVE-2026-114582: Server-side request forgery via SpatialReference
string input
- Record
MGASA-2026-0591- Updated
- 2026-11-12
OSVopenSUSE-SU-2026:12502-1No score
python313-Django4-4.2.30-7.1 on GA media
These are all security issues fixed in the python313-Django4-4.2.30-7.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12502-1- Updated
- 2026-11-10
OSVopenSUSE-SU-2026:12518-1No score
python313-Django-6.1.3-1.1 on GA media
These are all security issues fixed in the python313-Django-6.1.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12518-1- Updated
- 2026-11-11
OSVopenSUSE-SU-2026:12519-1No score
python313-Django5-5.2.19-1.1 on GA media
These are all security issues fixed in the python313-Django5-5.2.19-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12519-1- Updated
- 2026-11-11
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
py3-djangoAlpine:v3.24 | before 5.2.19-r0 | 5.2.19-r0 |
python-djangoDebian:12 | All versions, plus listed versions 3:3.2.19-13:3.2.19-1+deb12u13:3.2.19-1+deb12u1~bpo11+13:3.2.19-1+deb12u23:3.2.20-1 Show 45 moreShow less3:3.2.20-1.13:3.2.21-13:3.2.25-0+deb12u13:3.2.25-0+deb12u23:3.2.25-0+deb12u33:3.2.25-0+deb12u43:3.2.25-0+deb12u53:3.2.25-0+deb12u63:4.1-13:4.1.1-13:4.1.2-13:4.1.3-13:4.1.4-13:4.1.5-13:4.2-13:4.2.1-13:4.2.10-13:4.2.11-13:4.2.13-13:4.2.14-13:4.2.15-13:4.2.15-1~bpo12+13:4.2.16-13:4.2.17-13:4.2.17-23:4.2.18-13:4.2.18-1~bpo12+13:4.2.19-13:4.2.19-1~bpo12+13:4.2.2-13:4.2.20-13:4.2.20-1~bpo12+13:4.2.21-13:4.2.21-1~bpo12+13:4.2.22-13:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-13:4.2.27-13:4.2.27-23:4.2.28-13:4.2.29-13:4.2.3-1 | None known |
python-djangoDebian:13 | All versions, plus listed versions 3:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-1 Show 45 moreShow less3:4.2.27-0+deb13u13:4.2.27-13:4.2.27-23:4.2.28-0+deb13u13:4.2.28-0+deb13u23:4.2.28-13:4.2.29-13:4.2.30-13:5.0-13:5.0.1-13:5.0.2-13:5.0.3-13:5.0.4-13:5.0.6-13:5.0~alpha1-13:5.0~rc1-13:5.1-13:5.1.1-13:5.1.2-13:5.1.3-13:5.1.4-13:5.1.5-13:5.1~alpha1-13:5.1~beta1-13:5.1~rc1-13:5.2-13:5.2.1-13:5.2.13-13:5.2.14-13:5.2.14-23:5.2.15-13:5.2.15-23:5.2.15-2~bpo13+13:5.2.16-13:5.2.16-1~bpo13+13:5.2.17-13:5.2.17-23:5.2.17-2~bpo13+13:5.2.18-13:5.2.18-23:5.2.19-13:5.2.2-13:5.2.3-13:5.2.4-13:5.2.5-1 | None known |
python-djangoDebian:14 | before 3:5.2.19-1, plus listed versions 3:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-1 Show 45 moreShow less3:4.2.27-13:4.2.27-23:4.2.28-13:4.2.29-13:4.2.30-13:5.0-13:5.0.1-13:5.0.2-13:5.0.3-13:5.0.4-13:5.0.6-13:5.0~alpha1-13:5.0~rc1-13:5.1-13:5.1.1-13:5.1.2-13:5.1.3-13:5.1.4-13:5.1.5-13:5.1~alpha1-13:5.1~beta1-13:5.1~rc1-13:5.2-13:5.2.1-13:5.2.13-13:5.2.14-13:5.2.14-23:5.2.15-13:5.2.15-23:5.2.15-2~bpo13+13:5.2.16-13:5.2.16-1~bpo13+13:5.2.17-13:5.2.17-23:5.2.17-2~bpo13+13:5.2.18-13:5.2.18-23:5.2.2-13:5.2.3-13:5.2.4-13:5.2.5-13:5.2.6-13:5.2~alpha1-13:5.2~beta1-13:5.2~rc1-1 | 3:5.2.19-1 |
python-djangoMageia:10 From an advisory covering 6 CVEs | before 5.2.19-1.mga10 | 5.2.19-1.mga10 |
python-djangoUbuntu:Pro:14.04:LTS | All versions, plus listed versions 1.5.4-1ubuntu11.6-11.6.1-11.6.1-21.6.1-2ubuntu0.1 Show 30 moreShow less1.6.1-2ubuntu0.21.6.1-2ubuntu0.31.6.1-2ubuntu0.41.6.1-2ubuntu0.51.6.1-2ubuntu0.61.6.1-2ubuntu0.81.6.1-2ubuntu0.91.6.1-2ubuntu0.101.6.1-2ubuntu0.111.6.1-2ubuntu0.121.6.1-2ubuntu0.131.6.1-2ubuntu0.141.6.1-2ubuntu0.151.6.1-2ubuntu0.161.6.11-0ubuntu11.6.11-0ubuntu1.11.6.11-0ubuntu1.21.6.11-0ubuntu1.31.6.11-0ubuntu1.3+esm11.6.11-0ubuntu1.3+esm21.6.11-0ubuntu1.3+esm31.6.11-0ubuntu1.3+esm41.6.11-0ubuntu1.3+esm51.6.11-0ubuntu1.3+esm61.6.11-0ubuntu1.3+esm71.6.11-0ubuntu1.3+esm81.6.11-0ubuntu1.3+esm91.6.11-0ubuntu1.3+esm101.6.11-0ubuntu1.3+esm111.6.11-0ubuntu1.3+esm12 | None known |
python-djangoUbuntu:Pro:16.04:LTS | All versions, plus listed versions 1.7.9-1ubuntu51.8.5-2ubuntu11.8.7-1ubuntu11.8.7-1ubuntu21.8.7-1ubuntu3 Show 28 moreShow less1.8.7-1ubuntu41.8.7-1ubuntu51.8.7-1ubuntu5.11.8.7-1ubuntu5.21.8.7-1ubuntu5.41.8.7-1ubuntu5.51.8.7-1ubuntu5.61.8.7-1ubuntu5.71.8.7-1ubuntu5.81.8.7-1ubuntu5.91.8.7-1ubuntu5.101.8.7-1ubuntu5.111.8.7-1ubuntu5.121.8.7-1ubuntu5.131.8.7-1ubuntu5.141.8.7-1ubuntu5.151.8.7-1ubuntu5.15+esm11.8.7-1ubuntu5.15+esm31.8.7-1ubuntu5.15+esm41.8.7-1ubuntu5.15+esm51.8.7-1ubuntu5.15+esm61.8.7-1ubuntu5.15+esm71.8.7-1ubuntu5.15+esm81.8.7-1ubuntu5.15+esm91.8.7-1ubuntu5.15+esm101.8.7-1ubuntu5.15+esm111.8.7-1ubuntu5.15+esm121.8.7-1ubuntu5.15+esm13 | None known |
python-djangoUbuntu:Pro:18.04:LTS | All versions, plus listed versions 1:1.11.4-1ubuntu11:1.11.6-1ubuntu11:1.11.9-1ubuntu11:1.11.11-1ubuntu11:1.11.11-1ubuntu1.1 Show 36 moreShow less1:1.11.11-1ubuntu1.21:1.11.11-1ubuntu1.31:1.11.11-1ubuntu1.41:1.11.11-1ubuntu1.51:1.11.11-1ubuntu1.61:1.11.11-1ubuntu1.71:1.11.11-1ubuntu1.81:1.11.11-1ubuntu1.91:1.11.11-1ubuntu1.101:1.11.11-1ubuntu1.111:1.11.11-1ubuntu1.121:1.11.11-1ubuntu1.131:1.11.11-1ubuntu1.141:1.11.11-1ubuntu1.151:1.11.11-1ubuntu1.161:1.11.11-1ubuntu1.171:1.11.11-1ubuntu1.181:1.11.11-1ubuntu1.191:1.11.11-1ubuntu1.201:1.11.11-1ubuntu1.211:1.11.11-1ubuntu1.21+esm11:1.11.11-1ubuntu1.21+esm21:1.11.11-1ubuntu1.21+esm31:1.11.11-1ubuntu1.21+esm41:1.11.11-1ubuntu1.21+esm51:1.11.11-1ubuntu1.21+esm61:1.11.11-1ubuntu1.21+esm71:1.11.11-1ubuntu1.21+esm81:1.11.11-1ubuntu1.21+esm91:1.11.11-1ubuntu1.21+esm101:1.11.11-1ubuntu1.21+esm111:1.11.11-1ubuntu1.21+esm121:1.11.11-1ubuntu1.21+esm131:1.11.11-1ubuntu1.21+esm141:1.11.11-1ubuntu1.21+esm151:1.11.11-1ubuntu1.21+esm17 | None known |
python-djangoUbuntu:Pro:20.04:LTS | All versions, plus listed versions 1:1.11.22-1ubuntu12:2.2.6-1ubuntu12:2.2.9-2ubuntu12:2.2.10-12:2.2.10-1ubuntu1 Show 40 moreShow less2:2.2.11-12:2.2.12-12:2.2.12-1ubuntu0.12:2.2.12-1ubuntu0.22:2.2.12-1ubuntu0.32:2.2.12-1ubuntu0.42:2.2.12-1ubuntu0.52:2.2.12-1ubuntu0.62:2.2.12-1ubuntu0.72:2.2.12-1ubuntu0.82:2.2.12-1ubuntu0.92:2.2.12-1ubuntu0.102:2.2.12-1ubuntu0.112:2.2.12-1ubuntu0.122:2.2.12-1ubuntu0.132:2.2.12-1ubuntu0.142:2.2.12-1ubuntu0.152:2.2.12-1ubuntu0.162:2.2.12-1ubuntu0.172:2.2.12-1ubuntu0.182:2.2.12-1ubuntu0.192:2.2.12-1ubuntu0.202:2.2.12-1ubuntu0.212:2.2.12-1ubuntu0.222:2.2.12-1ubuntu0.232:2.2.12-1ubuntu0.242:2.2.12-1ubuntu0.252:2.2.12-1ubuntu0.262:2.2.12-1ubuntu0.272:2.2.12-1ubuntu0.282:2.2.12-1ubuntu0.292:2.2.12-1ubuntu0.29+esm12:2.2.12-1ubuntu0.29+esm22:2.2.12-1ubuntu0.29+esm32:2.2.12-1ubuntu0.29+esm42:2.2.12-1ubuntu0.29+esm52:2.2.12-1ubuntu0.29+esm62:2.2.12-1ubuntu0.29+esm72:2.2.12-1ubuntu0.29+esm82:2.2.12-1ubuntu0.29+esm10 | None known |
python-djangoUbuntu:22.04:LTS | All versions, plus listed versions 2:2.2.24-1ubuntu12:3.2.12-22:3.2.12-2ubuntu12:3.2.12-2ubuntu1.12:3.2.12-2ubuntu1.2 Show 26 moreShow less2:3.2.12-2ubuntu1.32:3.2.12-2ubuntu1.42:3.2.12-2ubuntu1.52:3.2.12-2ubuntu1.62:3.2.12-2ubuntu1.72:3.2.12-2ubuntu1.82:3.2.12-2ubuntu1.92:3.2.12-2ubuntu1.102:3.2.12-2ubuntu1.112:3.2.12-2ubuntu1.122:3.2.12-2ubuntu1.132:3.2.12-2ubuntu1.142:3.2.12-2ubuntu1.152:3.2.12-2ubuntu1.162:3.2.12-2ubuntu1.172:3.2.12-2ubuntu1.182:3.2.12-2ubuntu1.192:3.2.12-2ubuntu1.202:3.2.12-2ubuntu1.212:3.2.12-2ubuntu1.222:3.2.12-2ubuntu1.232:3.2.12-2ubuntu1.242:3.2.12-2ubuntu1.252:3.2.12-2ubuntu1.262:3.2.12-2ubuntu1.272:3.2.12-2ubuntu1.29 | None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-djangoUbuntu:24.04:LTS | All versions, plus listed versions 3:4.2.4-1ubuntu23:4.2.8-13:4.2.9-13:4.2.11-13:4.2.11-1ubuntu1 Show 17 moreShow less3:4.2.11-1ubuntu1.13:4.2.11-1ubuntu1.23:4.2.11-1ubuntu1.33:4.2.11-1ubuntu1.43:4.2.11-1ubuntu1.53:4.2.11-1ubuntu1.63:4.2.11-1ubuntu1.73:4.2.11-1ubuntu1.83:4.2.11-1ubuntu1.93:4.2.11-1ubuntu1.103:4.2.11-1ubuntu1.113:4.2.11-1ubuntu1.123:4.2.11-1ubuntu1.133:4.2.11-1ubuntu1.143:4.2.11-1ubuntu1.153:4.2.11-1ubuntu1.163:4.2.11-1ubuntu1.18 | None known |
python-djangoUbuntu:26.10 | All versions, plus listed versions 3:5.2.9-0ubuntu43:5.2.16-13:5.2.17-1 | None known |
python-djangoUbuntu:26.04:LTS | All versions, plus listed versions 3:5.2.4-1ubuntu23:5.2.4-1ubuntu33:5.2.9-0ubuntu13:5.2.9-0ubuntu23:5.2.9-0ubuntu33:5.2.9-0ubuntu43:5.2.9-0ubuntu4.13:5.2.9-0ubuntu4.3 | None known |
python-Django4openSUSE:Tumbleweed From an advisory covering 5 CVEs | before 4.2.30-7.1 | 4.2.30-7.1 |
python-DjangoopenSUSE:Tumbleweed From an advisory covering 6 CVEs | before 6.1.3-1.1 | 6.1.3-1.1 |
python-Django5openSUSE:Tumbleweed From an advisory covering 5 CVEs | before 5.2.19-1.1 | 5.2.19-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected | OSV | |
| published | OSV | |
| references | OSV | |
| affected, aliases, facts, references | OSV | |
| affected | OSV | |
| affected, aliases, published, references | OSV | |
| references | OSV |
Show 6 moreShow less
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | NVD, OSV | |
| published | EUVD | |
| published | CVE List, EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-114582 is a medium vulnerability (CVSS 6.9) in Djangoproject Django, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in py3-django 5.2.19-r0.
References
docs.djangoproject.com/en/dev/releases/security
groups.google.com/g/django-announce
github.com/django/django/commit/3a2ec4378b53c7b8ff5283ad7eba624ffa6f2b2f
Show 19 moreShow less
djangoproject.com/weblog/2026/nov/03/security-releases
nvd.nist.gov/vuln/detail/CVE-2026-114582
security.alpinelinux.org/vuln/CVE-2026-114582
pypi.org/project/Django
security-tracker.debian.org/tracker/CVE-2026-114582
advisories.mageia.org/MGASA-2026-0591.html
bugs.mageia.org/show_bug.cgi?id=36683
openwall.com/lists/oss-security/2026/11/03/8
ubuntu.com/security/CVE-2026-114582
cve.org/CVERecord?id=CVE-2026-114582
suse.com/security/cve/CVE-2026-108147
Left out here: 87 versions. The JSON record has them.