April 7, 2026
\nDjango 6.0.4 fixes one security issue with severity “moderate”, four security\nissues with severity “low”, and several bugs in 6.0.3. Also, the latest string\ntranslations from Transifex are incorporated.
\nASGIRequest normalizes header names following WSGI conventions, mapping\nhyphens to underscores. As a result, even in configurations where reverse\nproxies carefully strip security-sensitive headers named with hyphens, such a\nheader could be spoofed by supplying a header named with underscores.
Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous\nmappings. (Django’s runserver was patched in CVE 2015-0219.) But\nunder ASGI, there is not the same uniform expectation, even if many proxies\nprotect against this under default configuration (including nginx via\nunderscores_in_headers off;).
Headers containing underscores are now ignored by ASGIRequest, matching the\nbehavior of Daphne, the reference server for ASGI.
This issue has severity “low” according to the Django security policy.
\nGenericInlineModelAdminLink to this heading#Add permissions on inline model instances were not validated on submission of\nforged POST data in\nGenericInlineModelAdmin.
This issue has severity “low” according to the Django security policy.
\nModelAdmin.list_editableLink to this heading#Admin changelist forms using\nlist_editable incorrectly allowed new\ninstances to be created via forged POST data.
This issue has severity “low” according to the Django security policy.
\nMultiPartParser via base64-encoded file uploadLink to this heading#When using django.http.multipartparser.MultiPartParser, multipart uploads\nwith Content-Transfer-Encoding: base64 that include excessive whitespace\nmay trigger repeated memory copying, potentially degrading performance.
This issue has severity “moderate” according to the Django security\npolicy.
\nASGI requests with a missing or understated Content-Length header could\nbypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading\nHttpRequest.body, potentially loading an unbounded request body into\nmemory and causing service degradation.
This issue has severity “low” according to the Django security policy.
\nFixed a regression in Django 6.0 where alogin()\nand alogout() did not respectively set or clear\nrequest.user if it had already been materialized (e.g., by sync\nmiddleware) (#37017).
Fixed a regression in Django 6.0 in admin forms where\nRelatedFieldWidgetWrapper incorrectly wrapped all widgets in a\n<fieldset> (#36949).
Fixed a bug in Django 6.0 where the fields.E348 system check did not\ndetect name clashes between model managers and\nrelated_names for non-self-referential\nrelationships (#36973).