{"id":"CVE-2026-87890","aliases":["ALPINE-CVE-2026-87890","DEBIAN-CVE-2026-87890","EUVD-2026-93388","GHSA-7cqx-w4gp-37v7","MGASA-2026-0510","SUSE-SU-2026:4626-1","UBUNTU-CVE-2026-87890","openSUSE-SU-2026:12086-1","openSUSE-SU-2026:12095-1","openSUSE-SU-2026:12103-1","openSUSE-SU-2026:22196-1"],"status":"published","title":"Potential request forgery via spatial lookup byte values","description":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\nAn incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank sicksec for reporting this issue.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00275,"percentile":0.20207,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2026-10-06T13:35:37Z","modified":"2026-11-09T14:00:10Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["5.2.18-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["3:5.2.18-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.18-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.18-1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-1","3:4.2.29-1","3:4.2.30-1","3:5.0-1","3:5.0.1-1","3:5.0.2-1","3:5.0.3-1","3:5.0.4-1","3:5.0.6-1","3:5.0~alpha1-1","3:5.0~rc1-1","3:5.1-1","3:5.1.1-1","3:5.1.2-1","3:5.1.3-1","3:5.1.4-1","3:5.1.5-1","3:5.1~alpha1-1","3:5.1~beta1-1","3:5.1~rc1-1","3:5.2-1","3:5.2.1-1","3:5.2.13-1","3:5.2.14-1","3:5.2.14-2","3:5.2.15-1","3:5.2.15-2","3:5.2.15-2~bpo13+1","3:5.2.16-1","3:5.2.16-1~bpo13+1","3:5.2.17-1","3:5.2.17-2","3:5.2.17-2~bpo13+1","3:5.2.2-1","3:5.2.3-1","3:5.2.4-1","3:5.2.5-1","3:5.2.6-1","3:5.2~alpha1-1","3:5.2~beta1-1","3:5.2~rc1-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.18-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.68.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7","1.6.11-0ubuntu1.3+esm8","1.6.11-0ubuntu1.3+esm9","1.6.11-0ubuntu1.3+esm10","1.6.11-0ubuntu1.3+esm11","1.6.11-0ubuntu1.3+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13","1.8.7-1ubuntu5.14","1.8.7-1ubuntu5.15","1.8.7-1ubuntu5.15+esm1","1.8.7-1ubuntu5.15+esm3","1.8.7-1ubuntu5.15+esm4","1.8.7-1ubuntu5.15+esm5","1.8.7-1ubuntu5.15+esm6","1.8.7-1ubuntu5.15+esm7","1.8.7-1ubuntu5.15+esm8","1.8.7-1ubuntu5.15+esm9","1.8.7-1ubuntu5.15+esm10","1.8.7-1ubuntu5.15+esm11","1.8.7-1ubuntu5.15+esm12","1.8.7-1ubuntu5.15+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5","1:1.11.11-1ubuntu1.21+esm6","1:1.11.11-1ubuntu1.21+esm7","1:1.11.11-1ubuntu1.21+esm8","1:1.11.11-1ubuntu1.21+esm9","1:1.11.11-1ubuntu1.21+esm10","1:1.11.11-1ubuntu1.21+esm11","1:1.11.11-1ubuntu1.21+esm12","1:1.11.11-1ubuntu1.21+esm13","1:1.11.11-1ubuntu1.21+esm14","1:1.11.11-1ubuntu1.21+esm15","1:1.11.11-1ubuntu1.21+esm17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2","2:2.2.12-1ubuntu0.29+esm3","2:2.2.12-1ubuntu0.29+esm4","2:2.2.12-1ubuntu0.29+esm5","2:2.2.12-1ubuntu0.29+esm6","2:2.2.12-1ubuntu0.29+esm7","2:2.2.12-1ubuntu0.29+esm8","2:2.2.12-1ubuntu0.29+esm10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20","2:3.2.12-2ubuntu1.21","2:3.2.12-2ubuntu1.22","2:3.2.12-2ubuntu1.23","2:3.2.12-2ubuntu1.24","2:3.2.12-2ubuntu1.25","2:3.2.12-2ubuntu1.26","2:3.2.12-2ubuntu1.27","2:3.2.12-2ubuntu1.29"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9","3:4.2.11-1ubuntu1.10","3:4.2.11-1ubuntu1.11","3:4.2.11-1ubuntu1.12","3:4.2.11-1ubuntu1.13","3:4.2.11-1ubuntu1.14","3:4.2.11-1ubuntu1.15","3:4.2.11-1ubuntu1.16","3:4.2.11-1ubuntu1.18"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:5.2.9-0ubuntu4","3:5.2.16-1","3:5.2.17-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:5.2.4-1ubuntu2","3:5.2.4-1ubuntu3","3:5.2.9-0ubuntu1","3:5.2.9-0ubuntu2","3:5.2.9-0ubuntu3","3:5.2.9-0ubuntu4","3:5.2.9-0ubuntu4.1","3:5.2.9-0ubuntu4.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.18-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.2-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-bp160.12.1"}]}],"bundled":4}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["vendor-advisory","advisory"]},{"url":"https://groups.google.com/g/django-announce","tags":["mailing-list","article"]},{"url":"https://github.com/django/django/commit/ebcb13b327301f28cbc6cd5e4988a719f00575aa","tags":["patch","fix"]},{"url":"https://github.com/django/django/commit/4e77ef1e69c94780006b82795aa7db101996c3af","tags":["patch","fix"]},{"url":"https://github.com/django/django/commit/a2347fe8234a1831d56c875acc0ea51e0742957c","tags":["patch","fix"]},{"url":"https://github.com/django/django/commit/dd0558d1617619e0d66163675ef02135d0f54e5f","tags":["patch","fix"]},{"url":"https://www.djangoproject.com/weblog/2026/oct/06/security-releases/","tags":["vendor-advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87890","tags":["advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"url":"https://www.djangoproject.com/weblog/2026/oct/06/security-releases"},{"url":"https://github.com/advisories/GHSA-7cqx-w4gp-37v7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-87890","tags":["advisory"]},{"url":"https://github.com/django/django/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87890.json","tags":["advisory"]},{"url":"https://pypi.org/project/Django/","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-87890","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0510.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36465","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/06/3","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264626-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1284471","tags":["report"]},{"url":"https://bugzilla.suse.com/1284472","tags":["report"]},{"url":"https://bugzilla.suse.com/1284476","tags":["report"]},{"url":"https://bugzilla.suse.com/1284481","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87975","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-87890","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87890","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-87890","title":"Potential request forgery via spatial lookup byte values","description":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\nAn incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank sicksec for reporting this issue.","status":"published","published":"2026-10-06T13:35:37.964Z","modified":"2026-10-06T14:06:56.731Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:37:47.463822Z"}],"euvd":[{"id":"EUVD-2026-93388","description":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\nAn incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank sicksec for reporting this issue.","status":"published","published":"2026-10-06T13:35:37Z","modified":"2026-10-06T14:06:56Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:37.480805Z"}],"ghsa":[{"id":"GHSA-7cqx-w4gp-37v7","title":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\nAn...","description":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\nAn incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank sicksec for reporting this issue.","status":"published","published":"2026-10-06T15:32:00Z","modified":"2026-10-06T15:32:01Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:12:50.930323Z"}],"nvd":[{"id":"CVE-2026-87890","description":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\nAn incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank sicksec for reporting this issue.","status":"published","published":"2026-10-06T14:17:47.38Z","modified":"2026-10-06T14:17:47.517Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:54.486849Z"}],"osv":[{"id":"ALPINE-CVE-2026-87890","description":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\nAn incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank sicksec for reporting this issue.","status":"published","published":"2026-10-06T14:17:47.38Z","modified":"2026-11-03T06:32:57.130603902Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2026-87890","title":"Potential request forgery via spatial lookup byte values","description":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\nAn incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank sicksec for reporting this issue.","status":"published","published":"2026-10-06T13:35:37.964Z","modified":"2026-11-01T17:27:54.699052413Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-87890","description":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank sicksec for reporting this issue.","status":"published","published":"2026-10-06T14:17:47.38Z","modified":"2026-11-09T14:00:10.498088318Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-09T14:31:39.434822Z"},{"id":"UBUNTU-CVE-2026-87890","description":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank sicksec for reporting this issue.","status":"published","published":"2026-10-06T14:17:00Z","modified":"2026-10-17T13:01:15.168224204Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"MGASA-2026-0510","title":"Updated python-django package fixes security vulnerabilities","description":"Potential denial-of-service vulnerability in\n`get_supported_language_variant()`. (CVE-2026-77050)\nPotential denial-of-service vulnerability in HTTP header parsing.\n(CVE-2026-84429)\nPotential request forgery via spatial lookup byte values.\n(CVE-2026-87890)\nPrivilege abuse in model formsets with editable primary keys.\n(CVE-2026-87975)\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:30:03.208654909Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12086-1","title":"python313-Django4-4.2.30-6.1 on GA media","description":"These are all security issues fixed in the python313-Django4-4.2.30-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-09T17:23:13.917795578Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12095-1","title":"python313-Django5-5.2.18-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.18-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-09T00:00:00Z","modified":"2026-10-10T17:23:23.037807083Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12103-1","title":"python313-Django-6.1.2-1.1 on GA media","description":"These are all security issues fixed in the python313-Django-6.1.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-10T00:00:00Z","modified":"2026-10-11T12:45:03.8612306Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22196-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nChanges in python-Django:\n\n- CVE-2026-87975: an authenticated user permitted to submit a\n  formset to delete rows outside the limiting queryset, without any\n  permission on the targeted object, marking an out-of-queryset\n  object for deletion (bsc#1284471)\n- CVE-2026-87890: An incomplete fix for CVE-2026-15307 in Django\n  spatial lookups allows an attacker who can supply `bytes` values\n  to cause the Django process to make network requests via a\n  crafted VRT document (bsc#1284472)\n- CVE-2026-84429: potential denial-of-service attack due to\n  quadratic time complexity when parsing a value with many\n  separators inside a quoted parameter (bsc#1284476)\n- CVE-2026-77050: potential denial-of-service in\n  `get_supported_language_variant()` when processing many distinct,\n  very long language codes (bsc#1284481)\n","status":"published","published":"2026-10-28T02:17:09Z","modified":"2026-11-01T17:23:29.618340445Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4626-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2026-77050: potential denial-of-service in `get_supported_language_variant()` when processing many distinct, very\n  long language codes (bsc#1284481).\n- CVE-2026-84429: potential denial-of-service attack due to quadratic time complexity when parsing a value with many\n  separators inside a quoted parameter (bsc#1284476).\n- CVE-2026-87890: An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply\n  `bytes` values to cause the Django process to make network requests via a crafted VRT document (bsc#1284472).\n- CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting queryset,\n  without any permission on the targeted object, marking an out-of-queryset object for deletion (bsc#1284471).\n","status":"published","published":"2026-10-12T14:57:16Z","modified":"2026-10-13T10:30:05.845414717Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}