{"id":"CVE-2025-13473","aliases":["ALPINE-CVE-2025-13473","BIT-django-2025-13473","CLSA-2026-1788166978","CLSA-2026-1788167080","CLSA-2026-1788344280","CLSA-2026-1788437086","CLSA-2026-1788933529","CLSA-2026-1789122433","CLSA-2026-1789122610","CLSA-2026-1789636222","CLSA-2026-1790061998","CLSA-2026-1793696695","DEBIAN-CVE-2025-13473","DLA-4484-1","DSA-6150-1","EUVD-2025-206740","GHSA-2mcm-79hx-8fxw","MGASA-2026-0032","OESA-2026-1307","OESA-2026-1308","OESA-2026-1309","OESA-2026-1343","OESA-2026-1344","OESA-2026-1507","PYSEC-2026-42","SUSE-SU-2026:0440-1","UBUNTU-CVE-2025-13473","USN-8009-1","openSUSE-SU-2026:10145-1","openSUSE-SU-2026:10160-1","openSUSE-SU-2026:10247-1","openSUSE-SU-2026:11270-1","openSUSE-SU-2026:20184-1"],"status":"published","title":"Username enumeration through timing difference in mod_wsgi authentication handler","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00798,"percentile":0.57011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2026-02-03T14:00:00Z","modified":"2026-11-03T13:30:03Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["6.0.2","5.2.11","4.2.28"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["4.2.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["4.2.28-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["4.2.28","5.2.11","6.0.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["3:3.2.25-0+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["3:4.2.28-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["3:4.2.28-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","fixed_in":["1.6.11-0ubuntu1.3+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","fixed_in":["1.8.7-1ubuntu5.15+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","fixed_in":["1:1.11.11-1ubuntu1.21+esm14"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","fixed_in":["2:2.2.12-1ubuntu0.29+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-django","fixed_in":["2:3.2.12-2ubuntu1.25"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-django","fixed_in":["3:4.2.11-1ubuntu1.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-django","fixed_in":["3:5.2.4-1ubuntu2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"python-django","fixed_in":["3:5.2.9-0ubuntu3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0a1"},{"fixed":"6.0.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2a1"},{"fixed":"5.2.11"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2a1"},{"fixed":"4.2.28"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.28-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.0"},{"fixed":"4.2.28"},{"introduced":"5.2.0"},{"fixed":"5.2.11"},{"introduced":"6.0.0"},{"fixed":"6.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.10"},{"fixed":"5.1.10.post3+tuxcare"}]}],"versions":["5.1.10","5.1.10.post1+tuxcare","5.1.10.post2+tuxcare"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.post9+tuxcare"}]}],"versions":["4.2","4.2.post1+tuxcare","4.2.post2+tuxcare","4.2.post3+tuxcare","4.2.post4+tuxcare","4.2.post5+tuxcare","4.2.post6+tuxcare","4.2.post7+tuxcare","4.2.post8+tuxcare"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9"},{"fixed":"5.1.9.post4+tuxcare"}]}],"versions":["5.1.9","5.1.9.post1+tuxcare","5.1.9.post2+tuxcare","5.1.9.post3+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4"},{"fixed":"5.1.4.post5+tuxcare"}]}],"versions":["5.1.4","5.1.4.post1+tuxcare","5.1.4.post2+tuxcare","5.1.4.post3+tuxcare","5.1.4.post4+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"fixed":"5.1.post7+tuxcare"}]}],"versions":["5.1","5.1.post1+tuxcare","5.1.post2+tuxcare","5.1.post3+tuxcare","5.1.post4+tuxcare","5.1.post5+tuxcare","5.1.post6+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"4.0.post18+tuxcare"}]}],"versions":["4.0","4.0.post1+tuxcare","4.0.post10+tuxcare","4.0.post11+tuxcare","4.0.post12+tuxcare","4.0.post13+tuxcare","4.0.post14+tuxcare","4.0.post15+tuxcare","4.0.post16+tuxcare","4.0.post17+tuxcare","4.0.post2+tuxcare","4.0.post3+tuxcare","4.0.post4+tuxcare","4.0.post5+tuxcare","4.0.post6+tuxcare","4.0.post7+tuxcare","4.0.post8+tuxcare","4.0.post9+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2"},{"fixed":"5.0.2.post8+tuxcare"}]}],"versions":["5.0.2","5.0.2.post1+tuxcare","5.0.2.post2+tuxcare","5.0.2.post3+tuxcare","5.0.2.post4+tuxcare","5.0.2.post5+tuxcare","5.0.2.post6+tuxcare","5.0.2.post7+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.1"},{"fixed":"5.0.1.post10+tuxcare"}]}],"versions":["5.0.1","5.0.1.post1+tuxcare","5.0.1.post2+tuxcare","5.0.1.post3+tuxcare","5.0.1.post4+tuxcare","5.0.1.post5+tuxcare","5.0.1.post6+tuxcare","5.0.1.post7+tuxcare","5.0.1.post8+tuxcare","5.0.1.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.post14+tuxcare"}]}],"versions":["5.0","5.0.post1+tuxcare","5.0.post10+tuxcare","5.0.post11+tuxcare","5.0.post12+tuxcare","5.0.post13+tuxcare","5.0.post2+tuxcare","5.0.post3+tuxcare","5.0.post4+tuxcare","5.0.post5+tuxcare","5.0.post6+tuxcare","5.0.post7+tuxcare","5.0.post8+tuxcare","5.0.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.25"},{"fixed":"3.2.25.post14+tuxcare"}]}],"versions":["3.2.25","3.2.25.post1+tuxcare","3.2.25.post10+tuxcare","3.2.25.post11+tuxcare","3.2.25.post12+tuxcare","3.2.25.post13+tuxcare","3.2.25.post2+tuxcare","3.2.25.post3+tuxcare","3.2.25.post4+tuxcare","3.2.25.post5+tuxcare","3.2.25.post6+tuxcare","3.2.25.post7+tuxcare","3.2.25.post8+tuxcare","3.2.25.post9+tuxcare"],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.25-0+deb12u2"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1","3:3.2.25-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.28-0+deb13u1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-0+deb13u1","3:4.2.27-1","3:4.2.27-2"]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.28-1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-1","3:4.2.27-2"]},{"source":"osv","ecosystem":"Debian:11","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.28-1~deb11u12"}]}],"versions":["2:2.2.24-1","2:2.2.25-1~deb11u1","2:2.2.26-1~deb11u1","2:2.2.28-1~deb11u1","2:2.2.28-1~deb11u10","2:2.2.28-1~deb11u11","2:2.2.28-1~deb11u2","2:2.2.28-1~deb11u3","2:2.2.28-1~deb11u4","2:2.2.28-1~deb11u5","2:2.2.28-1~deb11u6","2:2.2.28-1~deb11u7","2:2.2.28-1~deb11u8","2:2.2.28-1~deb11u9"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.25-0+deb12u2"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1","3:3.2.25-0+deb12u1"],"bundled":6},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.28-0+deb13u1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-0+deb13u1","3:4.2.27-1","3:4.2.27-2"],"bundled":6},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0a1"},{"fixed":"6.0.2"}]}],"versions":["6.0","6.0.1","6.0a1","6.0b1","6.0rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2a1"},{"fixed":"5.2.11"}]}],"versions":["5.2","5.2.1","5.2.10","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","5.2a1","5.2b1","5.2rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2a1"},{"fixed":"4.2.28"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.2","4.2.20","4.2.21","4.2.22","4.2.23","4.2.24","4.2.25","4.2.26","4.2.27","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","4.2a1","4.2b1","4.2rc1"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.13-1.10.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-12.oe2403"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-12.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-12.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-12.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-12.oe2403sp2"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-21.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.28"},{"introduced":"5.2"},{"fixed":"5.2.11"},{"introduced":"6.0"},{"fixed":"6.0.2"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.2","4.2.20","4.2.21","4.2.22","4.2.23","4.2.24","4.2.25","4.2.26","4.2.27","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","5.2","5.2.1","5.2.10","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","6.0","6.0.1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.47.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.47.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-0ubuntu1.3+esm10"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7","1.6.11-0ubuntu1.3+esm8","1.6.11-0ubuntu1.3+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.15+esm11"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13","1.8.7-1ubuntu5.14","1.8.7-1ubuntu5.15","1.8.7-1ubuntu5.15+esm1","1.8.7-1ubuntu5.15+esm3","1.8.7-1ubuntu5.15+esm4","1.8.7-1ubuntu5.15+esm5","1.8.7-1ubuntu5.15+esm6","1.8.7-1ubuntu5.15+esm7","1.8.7-1ubuntu5.15+esm8","1.8.7-1ubuntu5.15+esm9","1.8.7-1ubuntu5.15+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.21+esm14"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5","1:1.11.11-1ubuntu1.21+esm6","1:1.11.11-1ubuntu1.21+esm7","1:1.11.11-1ubuntu1.21+esm8","1:1.11.11-1ubuntu1.21+esm9","1:1.11.11-1ubuntu1.21+esm10","1:1.11.11-1ubuntu1.21+esm11","1:1.11.11-1ubuntu1.21+esm12","1:1.11.11-1ubuntu1.21+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.29+esm7"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2","2:2.2.12-1ubuntu0.29+esm3","2:2.2.12-1ubuntu0.29+esm4","2:2.2.12-1ubuntu0.29+esm5","2:2.2.12-1ubuntu0.29+esm6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.25"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20","2:3.2.12-2ubuntu1.21","2:3.2.12-2ubuntu1.22","2:3.2.12-2ubuntu1.23","2:3.2.12-2ubuntu1.24"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.14"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9","3:4.2.11-1ubuntu1.10","3:4.2.11-1ubuntu1.11","3:4.2.11-1ubuntu1.12","3:4.2.11-1ubuntu1.13"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.4-1ubuntu2.3"}]}],"versions":["3:4.2.18-1ubuntu1","3:4.2.18-1ubuntu1.1","3:5.2.4-1","3:5.2.4-1ubuntu1","3:5.2.4-1ubuntu2","3:5.2.4-1ubuntu2.1","3:5.2.4-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.9-0ubuntu3"}]}],"versions":["3:5.2.4-1ubuntu2","3:5.2.4-1ubuntu3","3:5.2.9-0ubuntu1","3:5.2.9-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-0ubuntu1.3+esm10"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7","1.6.11-0ubuntu1.3+esm8","1.6.11-0ubuntu1.3+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.15+esm11"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13","1.8.7-1ubuntu5.14","1.8.7-1ubuntu5.15","1.8.7-1ubuntu5.15+esm1","1.8.7-1ubuntu5.15+esm3","1.8.7-1ubuntu5.15+esm4","1.8.7-1ubuntu5.15+esm5","1.8.7-1ubuntu5.15+esm6","1.8.7-1ubuntu5.15+esm7","1.8.7-1ubuntu5.15+esm8","1.8.7-1ubuntu5.15+esm9","1.8.7-1ubuntu5.15+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.21+esm14"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5","1:1.11.11-1ubuntu1.21+esm6","1:1.11.11-1ubuntu1.21+esm7","1:1.11.11-1ubuntu1.21+esm8","1:1.11.11-1ubuntu1.21+esm9","1:1.11.11-1ubuntu1.21+esm10","1:1.11.11-1ubuntu1.21+esm11","1:1.11.11-1ubuntu1.21+esm12","1:1.11.11-1ubuntu1.21+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.29+esm7"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2","2:2.2.12-1ubuntu0.29+esm3","2:2.2.12-1ubuntu0.29+esm4","2:2.2.12-1ubuntu0.29+esm5","2:2.2.12-1ubuntu0.29+esm6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.25"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20","2:3.2.12-2ubuntu1.21","2:3.2.12-2ubuntu1.22","2:3.2.12-2ubuntu1.23","2:3.2.12-2ubuntu1.24"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.14"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9","3:4.2.11-1ubuntu1.10","3:4.2.11-1ubuntu1.11","3:4.2.11-1ubuntu1.12","3:4.2.11-1ubuntu1.13"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.4-1ubuntu2.3"}]}],"versions":["3:4.2.18-1ubuntu1","3:4.2.18-1ubuntu1.1","3:5.2.4-1","3:5.2.4-1ubuntu1","3:5.2.4-1ubuntu2","3:5.2.4-1ubuntu2.1","3:5.2.4-1ubuntu2.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.11-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.28-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-bp160.5.1"}]}],"bundled":6}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["vendor-advisory","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://groups.google.com/g/django-announce","tags":["mailing-list","Release Notes","article","web","advisory"]},{"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/","tags":["vendor-advisory","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13473","tags":["web","advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-42.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2mcm-79hx-8fxw","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-13473","tags":["advisory"]},{"url":"https://github.com/django/django/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13473.json","tags":["advisory"]},{"url":"https://pypi.org/project/Django/","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-13473","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0032.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35103","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8009-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1207","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1312","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1308","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1309","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1343","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1344","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1507","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260440-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257401","tags":["report"]},{"url":"https://bugzilla.suse.com/1257403","tags":["report"]},{"url":"https://bugzilla.suse.com/1257405","tags":["report"]},{"url":"https://bugzilla.suse.com/1257406","tags":["report"]},{"url":"https://bugzilla.suse.com/1257407","tags":["report"]},{"url":"https://bugzilla.suse.com/1257408","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-13473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-1207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-1285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-1287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-1312","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-13473","title":"Username enumeration through timing difference in mod_wsgi authentication handler","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-03T14:32:26.24Z","modified":"2026-02-03T16:19:15.167Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:32:43.10004Z"}],"euvd":[{"id":"EUVD-2025-206740","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-03T14:32:26Z","modified":"2026-02-03T16:19:15Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:45.084164Z"}],"ghsa":[{"id":"GHSA-2mcm-79hx-8fxw","title":"Django has Observable Timing Discrepancy","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\n\nDjango would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-03T15:30:23Z","modified":"2026-06-05T16:23:53Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2025-13473","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-03T15:16:11.593Z","modified":"2026-06-17T08:34:12.707Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:11:59.832225Z"}],"osv":[{"id":"ALPINE-CVE-2025-13473","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-03T15:16:11.593Z","modified":"2026-11-03T06:32:51.677405347Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2025-13473","title":"Username enumeration through timing difference in mod_wsgi authentication handler","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-03T14:32:26.24Z","modified":"2026-10-28T02:30:21.79962086Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-13473","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-03T15:16:11.593Z","modified":"2026-09-01T20:05:41.060242523Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-2mcm-79hx-8fxw","title":"Django has Observable Timing Discrepancy","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\n\nDjango would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-03T15:30:23Z","modified":"2026-09-10T03:50:33.805951644Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"OESA-2026-1307","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django versions before 6.0.2, before 5.2.11, and before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` is vulnerable to a timing attack, allowing remote attackers to enumerate valid usernames. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. This issue has been rated with a severity of \u0026quot;low\u0026quot; according to the Django security policy.(CVE-2025-13473)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.(CVE-2025-14550)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.(CVE-2026-1207)\n\nAn issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-1285)\n\nA SQL injection vulnerability exists in the FilteredRelation component of the Django framework. An attacker can execute arbitrary SQL commands by manipulating column aliases through a specially crafted dictionary containing control characters, passed via dictionary expansion as the **kwargs argument to QuerySet methods such as annotate(), aggregate(), extra(), values(), values_list(), and alias(). This could lead to unauthorized database access, sensitive data disclosure, or data tampering. Affected versions include Django 6.0 series (from 6.0a1 up to, but not including, 6.0.2), 5.2 series (from 5.2a1 up to, but not including, 5.2.11), and 4.2 series (from 4.2a1 up to, but not including, 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.(CVE-2026-1287)\n\nAn SQL injection vulnerability exists in the Django framework when the QuerySet.order_by() method processes column aliases containing periods, and the same alias is reused in FilteredRelation via a specially crafted dictionary using dictionary expansion. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized information disclosure or arbitrary code execution within the database. This vulnerability affects Django 6.0 (before version 6.0.2), Django 5.2 (before version 5.2.11), and Django 4.2 (before version 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2026-1312)","status":"published","published":"2026-02-06T11:10:20Z","modified":"2026-08-18T01:19:31.969921319Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1308","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django versions before 6.0.2, before 5.2.11, and before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` is vulnerable to a timing attack, allowing remote attackers to enumerate valid usernames. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. This issue has been rated with a severity of \u0026quot;low\u0026quot; according to the Django security policy.(CVE-2025-13473)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.(CVE-2025-14550)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.(CVE-2026-1207)\n\nAn issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-1285)\n\nA SQL injection vulnerability exists in the FilteredRelation component of the Django framework. An attacker can execute arbitrary SQL commands by manipulating column aliases through a specially crafted dictionary containing control characters, passed via dictionary expansion as the **kwargs argument to QuerySet methods such as annotate(), aggregate(), extra(), values(), values_list(), and alias(). This could lead to unauthorized database access, sensitive data disclosure, or data tampering. Affected versions include Django 6.0 series (from 6.0a1 up to, but not including, 6.0.2), 5.2 series (from 5.2a1 up to, but not including, 5.2.11), and 4.2 series (from 4.2a1 up to, but not including, 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.(CVE-2026-1287)\n\nAn SQL injection vulnerability exists in the Django framework when the QuerySet.order_by() method processes column aliases containing periods, and the same alias is reused in FilteredRelation via a specially crafted dictionary using dictionary expansion. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized information disclosure or arbitrary code execution within the database. This vulnerability affects Django 6.0 (before version 6.0.2), Django 5.2 (before version 5.2.11), and Django 4.2 (before version 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2026-1312)","status":"published","published":"2026-02-06T11:10:20Z","modified":"2026-08-18T01:19:32.219899408Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1309","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django versions before 6.0.2, before 5.2.11, and before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` is vulnerable to a timing attack, allowing remote attackers to enumerate valid usernames. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. This issue has been rated with a severity of \u0026quot;low\u0026quot; according to the Django security policy.(CVE-2025-13473)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.(CVE-2025-14550)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.(CVE-2026-1207)\n\nAn issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-1285)\n\nA SQL injection vulnerability exists in the FilteredRelation component of the Django framework. An attacker can execute arbitrary SQL commands by manipulating column aliases through a specially crafted dictionary containing control characters, passed via dictionary expansion as the **kwargs argument to QuerySet methods such as annotate(), aggregate(), extra(), values(), values_list(), and alias(). This could lead to unauthorized database access, sensitive data disclosure, or data tampering. Affected versions include Django 6.0 series (from 6.0a1 up to, but not including, 6.0.2), 5.2 series (from 5.2a1 up to, but not including, 5.2.11), and 4.2 series (from 4.2a1 up to, but not including, 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.(CVE-2026-1287)\n\nAn SQL injection vulnerability exists in the Django framework when the QuerySet.order_by() method processes column aliases containing periods, and the same alias is reused in FilteredRelation via a specially crafted dictionary using dictionary expansion. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized information disclosure or arbitrary code execution within the database. This vulnerability affects Django 6.0 (before version 6.0.2), Django 5.2 (before version 5.2.11), and Django 4.2 (before version 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2026-1312)","status":"published","published":"2026-02-06T11:10:20Z","modified":"2026-08-18T01:19:32.397832922Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1343","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django versions before 6.0.2, before 5.2.11, and before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` is vulnerable to a timing attack, allowing remote attackers to enumerate valid usernames. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. This issue has been rated with a severity of \u0026quot;low\u0026quot; according to the Django security policy.(CVE-2025-13473)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.(CVE-2025-14550)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.(CVE-2026-1207)\n\nAn issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-1285)\n\nA SQL injection vulnerability exists in the FilteredRelation component of the Django framework. An attacker can execute arbitrary SQL commands by manipulating column aliases through a specially crafted dictionary containing control characters, passed via dictionary expansion as the **kwargs argument to QuerySet methods such as annotate(), aggregate(), extra(), values(), values_list(), and alias(). This could lead to unauthorized database access, sensitive data disclosure, or data tampering. Affected versions include Django 6.0 series (from 6.0a1 up to, but not including, 6.0.2), 5.2 series (from 5.2a1 up to, but not including, 5.2.11), and 4.2 series (from 4.2a1 up to, but not including, 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.(CVE-2026-1287)\n\nAn SQL injection vulnerability exists in the Django framework when the QuerySet.order_by() method processes column aliases containing periods, and the same alias is reused in FilteredRelation via a specially crafted dictionary using dictionary expansion. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized information disclosure or arbitrary code execution within the database. This vulnerability affects Django 6.0 (before version 6.0.2), Django 5.2 (before version 5.2.11), and Django 4.2 (before version 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2026-1312)","status":"published","published":"2026-02-13T11:10:22Z","modified":"2026-08-18T01:19:33.501208686Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1344","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django versions before 6.0.2, before 5.2.11, and before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` is vulnerable to a timing attack, allowing remote attackers to enumerate valid usernames. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. This issue has been rated with a severity of \u0026quot;low\u0026quot; according to the Django security policy.(CVE-2025-13473)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.(CVE-2025-14550)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.(CVE-2026-1207)\n\nAn issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-1285)\n\nA SQL injection vulnerability exists in the FilteredRelation component of the Django framework. An attacker can execute arbitrary SQL commands by manipulating column aliases through a specially crafted dictionary containing control characters, passed via dictionary expansion as the **kwargs argument to QuerySet methods such as annotate(), aggregate(), extra(), values(), values_list(), and alias(). This could lead to unauthorized database access, sensitive data disclosure, or data tampering. Affected versions include Django 6.0 series (from 6.0a1 up to, but not including, 6.0.2), 5.2 series (from 5.2a1 up to, but not including, 5.2.11), and 4.2 series (from 4.2a1 up to, but not including, 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.(CVE-2026-1287)\n\nAn SQL injection vulnerability exists in the Django framework when the QuerySet.order_by() method processes column aliases containing periods, and the same alias is reused in FilteredRelation via a specially crafted dictionary using dictionary expansion. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized information disclosure or arbitrary code execution within the database. This vulnerability affects Django 6.0 (before version 6.0.2), Django 5.2 (before version 5.2.11), and Django 4.2 (before version 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2026-1312)","status":"published","published":"2026-02-13T11:10:22Z","modified":"2026-08-18T01:19:32.597645382Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1507","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django versions before 6.0.2, before 5.2.11, and before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` is vulnerable to a timing attack, allowing remote attackers to enumerate valid usernames. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. This issue has been rated with a severity of \u0026quot;low\u0026quot; according to the Django security policy.(CVE-2025-13473)\n\nAn issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.(CVE-2026-1207)\n\nAn issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-1285)\n\nA SQL injection vulnerability exists in the FilteredRelation component of the Django framework. An attacker can execute arbitrary SQL commands by manipulating column aliases through a specially crafted dictionary containing control characters, passed via dictionary expansion as the **kwargs argument to QuerySet methods such as annotate(), aggregate(), extra(), values(), values_list(), and alias(). This could lead to unauthorized database access, sensitive data disclosure, or data tampering. Affected versions include Django 6.0 series (from 6.0a1 up to, but not including, 6.0.2), 5.2 series (from 5.2a1 up to, but not including, 5.2.11), and 4.2 series (from 4.2a1 up to, but not including, 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.(CVE-2026-1287)\n\nAn SQL injection vulnerability exists in the Django framework when the QuerySet.order_by() method processes column aliases containing periods, and the same alias is reused in FilteredRelation via a specially crafted dictionary using dictionary expansion. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized information disclosure or arbitrary code execution within the database. This vulnerability affects Django 6.0 (before version 6.0.2), Django 5.2 (before version 5.2.11), and Django 4.2 (before version 4.2.28). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2026-1312)","status":"published","published":"2026-03-06T11:10:31Z","modified":"2026-08-18T01:19:35.847205685Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"PYSEC-2026-42","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-03T15:16:11.593Z","modified":"2026-06-10T17:01:07.622118437Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"UBUNTU-CVE-2025-13473","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-03T14:00:00Z","modified":"2026-05-20T16:20:22.166096897Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"BIT-django-2025-13473","title":"Username enumeration through timing difference in mod_wsgi authentication handler","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.","status":"published","published":"2026-02-05T08:38:16.508Z","modified":"2026-09-08T08:46:32.691443851Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"CLSA-2026-1788166978","title":"TuxCare security update for django (6 CVEs)","description":"TuxCare rebuilt django to address 6 CVEs. Fixed in 5.1.10.post3+tuxcare.","status":"published","published":"2026-08-31T09:02:58Z","modified":"2026-10-15T09:47:40.879748796Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788167080","title":"TuxCare security update for django (5 CVEs)","description":"TuxCare rebuilt django to address 5 CVEs. Fixed in 4.2.post9+tuxcare.","status":"published","published":"2026-08-31T09:04:40Z","modified":"2026-10-15T09:48:05.763171779Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788344280","title":"TuxCare security update for django (3 CVEs)","description":"TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.9.post4+tuxcare.","status":"published","published":"2026-09-02T10:18:00Z","modified":"2026-10-15T09:48:01.271093616Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788437086","title":"TuxCare security update for django (3 CVEs)","description":"TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.4.post5+tuxcare.","status":"published","published":"2026-09-03T12:04:46Z","modified":"2026-10-15T09:48:01.367968084Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788933529","title":"TuxCare security update for django (3 CVEs)","description":"TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.post7+tuxcare.","status":"published","published":"2026-09-09T05:58:49Z","modified":"2026-10-15T09:48:01.353489795Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789122433","title":"TuxCare security update for django (4 CVEs)","description":"TuxCare rebuilt django to address 4 CVEs. Fixed in 4.0.post18+tuxcare.","status":"published","published":"2026-09-11T10:27:13Z","modified":"2026-10-15T09:48:01.486306714Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789122610","title":"TuxCare security update for django (3 CVEs)","description":"TuxCare rebuilt django to address 3 CVEs. Fixed in 5.0.2.post8+tuxcare.","status":"published","published":"2026-09-11T10:30:10Z","modified":"2026-10-15T09:48:01.706300426Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789636222","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.1.post10+tuxcare.","status":"published","published":"2026-09-17T09:10:22Z","modified":"2026-10-15T09:48:01.959139837Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790061998","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.post14+tuxcare.","status":"published","published":"2026-09-22T07:26:38Z","modified":"2026-10-15T09:48:01.960408754Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1793696695","title":"TuxCare security update for django (9 CVEs)","description":"TuxCare rebuilt django to address 9 CVEs. Fixed in 3.2.25.post14+tuxcare.","status":"published","published":"2026-11-03T10:04:56Z","modified":"2026-11-03T13:30:03.177764505Z","updated_at":"2026-11-03T14:04:50.729288Z"},{"id":"DLA-4484-1","title":"python-django - security update","status":"published","published":"2026-02-19T00:00:00Z","modified":"2026-02-19T19:45:45.032905Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6150-1","title":"python-django - security update","status":"published","published":"2026-02-26T00:00:00Z","modified":"2026-02-26T23:15:36.925491Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2026-0032","title":"Updated python-django packages fix security vulnerabilities","description":"Username enumeration through timing difference in mod_wsgi\nauthentication handler. (CVE-2025-13473)\nPotential denial-of-service vulnerability via repeated headers when\nusing ASGI. (CVE-2025-14550)\nPotential SQL injection via raster lookups on PostGIS. (CVE-2026-1207)\nPotential denial-of-service vulnerability in django.utils.text.Truncator\nHTML methods. (CVE-2026-1285)\nPotential SQL injection in column aliases via control characters.\n(CVE-2026-1287)\nPotential SQL injection via QuerySet.order_by and FilteredRelation.\n(CVE-2026-1312)\n","status":"published","published":"2026-02-06T05:11:54Z","modified":"2026-04-16T04:44:39.947431934Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10145-1","title":"python312-Django6-6.0.2-1.1 on GA media","description":"These are all security issues fixed in the python312-Django6-6.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-04T00:00:00Z","modified":"2026-03-23T04:54:30.557337Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10160-1","title":"python311-Django-5.2.11-1.1 on GA media","description":"These are all security issues fixed in the python311-Django-5.2.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-06T00:00:00Z","modified":"2026-02-07T14:00:14.570289Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10247-1","title":"python311-Django4-4.2.28-1.1 on GA media","description":"These are all security issues fixed in the python311-Django4-4.2.28-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-24T00:00:00Z","modified":"2026-03-23T04:54:37.537846Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20184-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nChanges in python-Django:\n\n- CVE-2026-1312: Fixed potential SQL injection via QuerySet.order_by and FilteredRelation (bsc#1257408).\n- CVE-2026-1287: Fixed potential SQL injection in column aliases via control characters (bsc#1257407).\n- CVE-2026-1207: Fixed potential SQL injection via raster lookups on PostGIS (bsc#1257405).\n- CVE-2026-1285: Fixed potential denial-of-service in django.utils.text.Truncator HTML methods (bsc#1257406).\n- CVE-2025-13473: Fixed username enumeration through timing difference in mod_wsgi authentication handler (bsc#1257401).\n- CVE-2025-14550: Fixed potential denial-of-service via repeated headers when using ASGI (bsc#1257403).\n","status":"published","published":"2026-02-07T13:45:17Z","modified":"2026-03-23T04:54:46.886944Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0440-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2025-14550: Fixed potential denial-of-service via repeated \n  headers when using ASGI(bsc#1257403)\n- CVE-2026-1312: Fixed potential SQL injection via QuerySet.order_by \n  and FilteredRelation (bsc#1257408)\n- CVE-2026-1287: Fixed potential SQL injection in column aliases\n  via control characters (bsc#1257407)\n- CVE-2026-1207: Fixed potential SQL injection via raster lookups\n  on PostGIS (bsc#1257405)\n- CVE-2025-13473: Fixed username enumeration through timing difference\n  in mod_wsgi authentication handler (bsc#1257401)\n- CVE-2026-1285: Fixed potential denial-of-service in \n  django.utils.text.Truncator HTML methods (bsc#1257406)\n","status":"published","published":"2026-02-11T09:38:06Z","modified":"2026-03-23T04:52:15.091359Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"USN-8009-1","title":"python-django vulnerabilities","description":"It was discovered that Django exposed timing information when checking\npasswords. An attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2025-13473)\n\nJiyong Yang discovered that Django incorrectly handled malformed requests\nwith duplicate headers. An attacker could possibly use this issue to cause\na denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu\n24.04 LTS, and Ubuntu 25.10. (CVE-2025-14550)\n\nTarek Nakkouch discovered that Django incorrectly parsed raster lookups. An\nattacker could possibly use this issue to perform SQL injection attacks.\nThis issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04\nLTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-1207)\n\nSeokchan Yoon discovered that Django incorrectly handled malformed HTML\ninputs containing a large amount of unmatched HTML end tags. An attacker\ncould possibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04\nLTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-1285)\n\nSolomon Kebede discovered that Django incorrectly handled control\ncharacters in the dictionary expansion of certain QuerySet methods. An\nattacker could possibly use this issue to perform SQL injection attacks.\n(CVE-2026-1287)\n\nSolomon Kebede discovered that Django incorrectly handled column alias\nparsing with dictionary expansion. An attacker could possibly use this\nissue to perform SQL injection attacks. This issue only affected Ubuntu\n24.04 LTS and Ubuntu 25.10. (CVE-2026-1312)","status":"published","published":"2026-02-03T16:06:09Z","modified":"2026-06-30T18:15:16.944666641Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}