{"title":"Django 4.2.30 release notes","version":"dev","locale":"en","docname":"releases/4.2.30","url":"/en/dev/releases/4.2.30/","canonical":"https://djangodocs.dev/en/dev/releases/4.2.30/","summary":"Django 4.2.30 fixes one security issue with severity “moderate” and four security issues with severity “low” in 4.2.29.","html":"

Django 4.2.30 release notesLink to this heading#

\n

April 7, 2026

\n

Django 4.2.30 fixes one security issue with severity “moderate” and four\nsecurity issues with severity “low” in 4.2.29.

\n
\n

CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflationLink to this heading#

\n

ASGIRequest normalizes header names following WSGI conventions, mapping\nhyphens to underscores. As a result, even in configurations where reverse\nproxies carefully strip security-sensitive headers named with hyphens, such a\nheader could be spoofed by supplying a header named with underscores.

\n

Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous\nmappings. (Django’s runserver was patched in CVE 2015-0219.) But\nunder ASGI, there is not the same uniform expectation, even if many proxies\nprotect against this under default configuration (including nginx via\nunderscores_in_headers off;).

\n

Headers containing underscores are now ignored by ASGIRequest, matching the\nbehavior of Daphne, the reference server for ASGI.

\n

This issue has severity “low” according to the Django security policy.

\n
\n
\n

CVE-2026-4277: Privilege abuse in GenericInlineModelAdminLink to this heading#

\n

Add permissions on inline model instances were not validated on submission of\nforged POST data in\nGenericInlineModelAdmin.

\n

This issue has severity “low” according to the Django security policy.

\n
\n
\n

CVE-2026-4292: Privilege abuse in ModelAdmin.list_editableLink to this heading#

\n

Admin changelist forms using\nlist_editable incorrectly allowed new\ninstances to be created via forged POST data.

\n

This issue has severity “low” according to the Django security policy.

\n
\n
\n

CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploadLink to this heading#

\n

When using django.http.multipartparser.MultiPartParser, multipart uploads\nwith Content-Transfer-Encoding: base64 that include excessive whitespace\nmay trigger repeated memory copying, potentially degrading performance.

\n

This issue has severity “moderate” according to the Django security\npolicy.

\n
\n
\n

CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypassLink to this heading#

\n

ASGI requests with a missing or understated Content-Length header could\nbypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading\nHttpRequest.body, potentially loading an unbounded request body into\nmemory and causing service degradation.

\n

This issue has severity “low” according to the Django security policy.

\n
","rootId":"django-4-2-30-release-notes","toc":[{"title":"CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation","anchor":"cve-2026-3902-asgi-header-spoofing-via-underscore-hyphen-conflation","children":[]},{"title":"CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin","anchor":"cve-2026-4277-privilege-abuse-in-genericinlinemodeladmin","children":[]},{"title":"CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable","anchor":"cve-2026-4292-privilege-abuse-in-modeladmin-list-editable","children":[]},{"title":"CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload","anchor":"cve-2026-33033-potential-denial-of-service-vulnerability-in-multipartparser-via-base64-encoded-file-upload","children":[]},{"title":"CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass","anchor":"cve-2026-33034-potential-denial-of-service-vulnerability-in-asgi-requests-via-memory-upload-limit-bypass","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/5.0","title":"Django 5.0 release notes","url":"/en/dev/releases/5.0/"},"next":{"docname":"releases/4.2.29","title":"Django 4.2.29 release notes","url":"/en/dev/releases/4.2.29/"},"formats":{"html":"/en/dev/releases/4.2.30/","markdown":"/en/dev/releases/4.2.30.md","json":"/en/dev/releases/4.2.30.json"},"source":"https://github.com/django/django/blob/main/docs/releases/4.2.30.txt","official":"https://docs.djangoproject.com/en/dev/releases/4.2.30/","inVersions":["dev","6.1","6.0","5.2","4.2"],"inLocales":["en"]}