{"title":"Archive of security issues","version":"6.0","locale":"es","docname":"releases/security","url":"/es/6.0/releases/security/","canonical":"https://djangodocs.dev/es/6.0/releases/security/","summary":"Django’s development team is strongly committed to responsible reporting and disclosure of security-related issues, as outlined in Django’s security policies . As…","html":"

Archive of security issuesLink to this heading#

\n

Django’s development team is strongly committed to responsible\nreporting and disclosure of security-related issues, as outlined in\nDjango’s security policies.

\n

As part of that commitment, we maintain the following historical list\nof issues which have been fixed and disclosed. For each issue, the\nlist below includes the date, a brief description, the CVE identifier\nif applicable, a list of affected versions, a link to the full\ndisclosure and links to the appropriate patch(es).

\n

Some important caveats apply to this information:

\n\n
\n

Issues under Django’s security processLink to this heading#

\n

All security issues have been handled under versions of Django’s security\nprocess. These are listed below.

\n
\n

August 4, 2026 - CVE 2026-15307Link to this heading#

\n

Server-side file-write and request forgery via spatial lookups.\nFull description

\n\n
\n
\n

August 4, 2026 - CVE 2026-15337Link to this heading#

\n

Potential denial-of-service vulnerability in check_for_language().\nFull description

\n\n
\n
\n

August 4, 2026 - CVE 2026-15830Link to this heading#

\n

Potential denial-of-service vulnerability via nested geometry collections.\nFull description

\n\n
\n
\n

August 4, 2026 - CVE 2026-15920Link to this heading#

\n

Potential cross-site scripting via URLField values in the admin.\nFull description

\n\n
\n
\n

July 7, 2026 - CVE 2026-48588Link to this heading#

\n

Potential exposure of private data via cached Set-Cookie response.\nFull description

\n\n
\n
\n

July 7, 2026 - CVE 2026-53877Link to this heading#

\n

Heap buffer over-read in GDALRaster.\nFull description

\n\n
\n
\n

July 7, 2026 - CVE 2026-53878Link to this heading#

\n

Header injection possibility since DomainNameValidator accepted newlines in\ninput.\nFull description

\n\n
\n
\n

June 3, 2026 - CVE 2026-6873Link to this heading#

\n

Signed cookie salt namespace collision in\ndjango.http.HttpRequest.get_signed_cookie.\nFull description

\n\n
\n
\n

June 3, 2026 - CVE 2026-7666Link to this heading#

\n

Potential unencrypted email transmission via STARTTLS in the SMTP backend.\nFull description

\n\n
\n
\n

June 3, 2026 - CVE 2026-8404Link to this heading#

\n

Potential exposure of private data via case-sensitive Cache-Control\ndirectives in UpdateCacheMiddleware.\nFull description

\n\n
\n
\n

June 3, 2026 - CVE 2026-35193Link to this heading#

\n

Potential exposure of private data via missing Vary: Authorization in\nUpdateCacheMiddleware.\nFull description

\n\n
\n
\n

June 3, 2026 - CVE 2026-48587Link to this heading#

\n

Potential exposure of private data via whitespace padding in Vary header.\nFull description

\n\n
\n
\n

May 5, 2026 - CVE 2026-5766Link to this heading#

\n

Potential denial-of-service vulnerability in ASGI requests via file upload\nlimit bypass.\nFull description

\n\n
\n
\n

May 5, 2026 - CVE 2026-35192Link to this heading#

\n

Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST.\nFull description

\n\n
\n
\n

May 5, 2026 - CVE 2026-6907Link to this heading#

\n

Potential exposure of private data due to incorrect handling of Vary: * in\nUpdateCacheMiddleware.\nFull description

\n\n
\n
\n

April 7, 2026 - CVE 2026-3902Link to this heading#

\n

ASGI header spoofing via underscore/hyphen conflation.\nFull description

\n\n
\n
\n

April 7, 2026 - CVE 2026-4277Link to this heading#

\n

Privilege abuse in GenericInlineModelAdmin.\nFull description

\n\n
\n
\n

April 7, 2026 - CVE 2026-4292Link to this heading#

\n

Privilege abuse in ModelAdmin.list_editable.\nFull description

\n\n
\n
\n

April 7, 2026 - CVE 2026-33033Link to this heading#

\n

Potential denial-of-service vulnerability in MultiPartParser via\nbase64-encoded file upload.\nFull description

\n\n
\n
\n

April 7, 2026 - CVE 2026-33034Link to this heading#

\n

Potential denial-of-service vulnerability in ASGI requests via memory upload\nlimit bypass.\nFull description

\n\n
\n
\n

March 3, 2026 - CVE 2026-25673Link to this heading#

\n

Potential denial-of-service vulnerability in URLField via Unicode\nnormalization on Windows.\nFull description

\n\n
\n
\n

March 3, 2026 - CVE 2026-25674Link to this heading#

\n

Potential incorrect permissions on newly created file system objects.\nFull description

\n\n
\n
\n

February 3, 2026 - CVE 2025-13473Link to this heading#

\n

Username enumeration through timing difference in mod_wsgi authentication\nhandler.\nFull description

\n\n
\n
\n

February 3, 2026 - CVE 2025-14550Link to this heading#

\n

Potential denial-of-service vulnerability via repeated headers when using ASGI.\nFull description

\n\n
\n
\n

February 3, 2026 - CVE 2026-1207Link to this heading#

\n

Potential SQL injection via raster lookups on PostGIS.\nFull description

\n\n
\n
\n

February 3, 2026 - CVE 2026-1285Link to this heading#

\n

Potential denial-of-service vulnerability in django.utils.text.Truncator\nHTML methods.\nFull description

\n\n
\n
\n

February 3, 2026 - CVE 2026-1287Link to this heading#

\n

Potential SQL injection in column aliases via control characters.\nFull description

\n\n
\n
\n

February 3, 2026 - CVE 2026-1312Link to this heading#

\n

Potential SQL injection via QuerySet.order_by and FilteredRelation.\nFull description

\n\n
\n
\n

December 2, 2025 - CVE 2025-13372Link to this heading#

\n

Potential SQL injection in FilteredRelation column aliases on PostgreSQL.\nFull description

\n\n
\n
\n

December 2, 2025 - CVE 2025-64460Link to this heading#

\n

Potential denial-of-service vulnerability in XML serializer text extraction.\nFull description

\n\n
\n
\n

November 5, 2025 - CVE 2025-64458Link to this heading#

\n

Potential denial-of-service vulnerability in HttpResponseRedirect and\nHttpResponsePermanentRedirect on Windows. Full description

\n\n
\n
\n

November 5, 2025 - CVE 2025-64459Link to this heading#

\n

Potential SQL injection via _connector keyword argument in QuerySet and\nQ objects. Full description

\n\n
\n
\n

October 1, 2025 - CVE 2025-59681Link to this heading#

\n

Potential SQL injection in QuerySet.annotate(), alias(),\naggregate(), and extra() on MySQL and MariaDB. Full description

\n\n
\n
\n

October 1, 2025 - CVE 2025-59682Link to this heading#

\n

Potential partial directory-traversal via archive.extract().\nFull description

\n\n
\n
\n

September 3, 2025 - CVE 2025-57833Link to this heading#

\n

Potential SQL injection in FilteredRelation column aliases.\nFull description

\n\n
\n
\n

June 4, 2025 - CVE 2025-48432Link to this heading#

\n

Potential log injection via unescaped request path.\nFull description

\n\n

There was an additional hardening with new patch releases published on June 10,\n2025. Full description

\n\n
\n
\n

May 7, 2025 - CVE 2025-32873Link to this heading#

\n

Denial-of-service possibility in strip_tags().\nFull description

\n\n
\n
\n

April 2, 2025 - CVE 2025-27556Link to this heading#

\n

Potential denial-of-service vulnerability in LoginView, LogoutView, and\nset_language() on Windows. Full description

\n\n
\n
\n

March 6, 2025 - CVE 2025-26699Link to this heading#

\n

Potential denial-of-service in django.utils.text.wrap().\nFull description

\n\n
\n
\n

January 14, 2025 - CVE 2024-56374Link to this heading#

\n

Potential denial-of-service vulnerability in IPv6 validation.\nFull description

\n\n
\n
\n

December 4, 2024 - CVE 2024-53907Link to this heading#

\n

Potential denial-of-service in django.utils.html.strip_tags().\nFull description

\n\n
\n
\n

December 4, 2024 - CVE 2024-53908Link to this heading#

\n

Potential SQL injection in HasKey(lhs, rhs) on Oracle.\nFull description

\n\n
\n
\n

September 3, 2024 - CVE 2024-45231Link to this heading#

\n

Potential user email enumeration via response status on password reset.\nFull description

\n\n
\n
\n

September 3, 2024 - CVE 2024-45230Link to this heading#

\n

Potential denial-of-service vulnerability in django.utils.html.urlize().\nFull description

\n\n
\n
\n

August 6, 2024 - CVE 2024-42005Link to this heading#

\n

Potential SQL injection in QuerySet.values() and values_list().\nFull description

\n\n
\n
\n

August 6, 2024 - CVE 2024-41991Link to this heading#

\n

Potential denial-of-service vulnerability in django.utils.html.urlize() and\nAdminURLFieldWidget. Full description

\n\n
\n
\n

August 6, 2024 - CVE 2024-41990Link to this heading#

\n

Potential denial-of-service vulnerability in django.utils.html.urlize().\nFull description

\n\n
\n
\n

August 6, 2024 - CVE 2024-41989Link to this heading#

\n

Potential memory exhaustion in django.utils.numberformat.floatformat().\nFull description

\n\n
\n
\n

July 9, 2024 - CVE 2024-39614Link to this heading#

\n

Potential denial-of-service in\ndjango.utils.translation.get_supported_language_variant().\nFull description

\n\n
\n
\n

July 9, 2024 - CVE 2024-39330Link to this heading#

\n

Potential directory-traversal in django.core.files.storage.Storage.save().\nFull description

\n\n
\n
\n

July 9, 2024 - CVE 2024-39329Link to this heading#

\n

Username enumeration through timing difference for users with unusable\npasswords. Full description

\n\n
\n
\n

July 9, 2024 - CVE 2024-38875Link to this heading#

\n

Potential denial-of-service in django.utils.html.urlize().\nFull description

\n\n
\n
\n

March 4, 2024 - CVE 2024-27351Link to this heading#

\n

Potential regular expression denial-of-service in\ndjango.utils.text.Truncator.words(). Full description

\n\n
\n
\n

February 6, 2024 - CVE 2024-24680Link to this heading#

\n

Potential denial-of-service in intcomma template filter.\nFull description

\n\n
\n
\n

November 1, 2023 - CVE 2023-46695Link to this heading#

\n

Potential denial of service vulnerability in UsernameField on Windows.\nFull description

\n\n
\n
\n

October 4, 2023 - CVE 2023-43665Link to this heading#

\n

Denial-of-service possibility in django.utils.text.Truncator.\nFull description

\n\n
\n
\n

September 4, 2023 - CVE 2023-41164Link to this heading#

\n

Potential denial of service vulnerability in\ndjango.utils.encoding.uri_to_iri(). Full description

\n\n
\n
\n

July 3, 2023 - CVE 2023-36053Link to this heading#

\n

Potential regular expression denial of service vulnerability in\nEmailValidator/URLValidator. Full description

\n\n
\n
\n

May 3, 2023 - CVE 2023-31047Link to this heading#

\n

Potential bypass of validation when uploading multiple files using one form\nfield. Full description

\n\n
\n
\n

February 14, 2023 - CVE 2023-24580Link to this heading#

\n

Potential denial-of-service vulnerability in file uploads. Full description

\n\n
\n
\n

February 1, 2023 - CVE 2023-23969Link to this heading#

\n

Potential denial-of-service via Accept-Language headers. Full description

\n\n
\n
\n

October 4, 2022 - CVE 2022-41323Link to this heading#

\n

Potential denial-of-service vulnerability in internationalized URLs. Full\ndescription

\n\n
\n
\n

August 3, 2022 - CVE 2022-36359Link to this heading#

\n

Potential reflected file download vulnerability in FileResponse. Full\ndescription

\n\n
\n
\n

July 4, 2022 - CVE 2022-34265Link to this heading#

\n

Potential SQL injection via Trunc(kind) and Extract(lookup_name)\narguments. Full description

\n\n
\n
\n

April 11, 2022 - CVE 2022-28346Link to this heading#

\n

Potential SQL injection in QuerySet.annotate(), aggregate(), and\nextra(). Full description

\n\n
\n
\n

April 11, 2022 - CVE 2022-28347Link to this heading#

\n

Potential SQL injection via QuerySet.explain(**options) on PostgreSQL.\nFull description

\n\n
\n
\n

February 1, 2022 - CVE 2022-22818Link to this heading#

\n

Possible XSS via {% debug %} template tag. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 1, 2022 - CVE 2022-23833Link to this heading#

\n

Denial-of-service possibility in file uploads. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 4, 2022 - CVE 2021-45452Link to this heading#

\n

Potential directory-traversal via Storage.save(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 4, 2022 - CVE 2021-45116Link to this heading#

\n

Potential information disclosure in dictsort template filter. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 4, 2022 - CVE 2021-45115Link to this heading#

\n

Denial-of-service possibility in UserAttributeSimilarityValidator. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 7, 2021 - CVE 2021-44420Link to this heading#

\n

Potential bypass of an upstream access control based on URL paths. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 1, 2021 - CVE 2021-35042Link to this heading#

\n

Potential SQL injection via unsanitized QuerySet.order_by() input. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

June 2, 2021 - CVE 2021-33203Link to this heading#

\n

Potential directory traversal via admindocs. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

June 2, 2021 - CVE 2021-33571Link to this heading#

\n

Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted\nleading zeros in IPv4 addresses. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

May 6, 2021 - CVE 2021-32052Link to this heading#

\n

Header injection possibility since URLValidator accepted newlines in input\non Python 3.9.5+. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

May 4, 2021 - CVE 2021-31542Link to this heading#

\n

Potential directory-traversal via uploaded files. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 6, 2021 - CVE 2021-28658Link to this heading#

\n

Potential directory-traversal via uploaded files. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 19, 2021 - CVE 2021-23336Link to this heading#

\n

Web cache poisoning via django.utils.http.limited_parse_qsl(). Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 1, 2021 - CVE 2021-3281Link to this heading#

\n

Potential directory-traversal via archive.extract(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 1, 2020 - CVE 2020-24584Link to this heading#

\n

Permission escalation in intermediate-level directories of the file system\ncache on Python 3.7+. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 1, 2020 - CVE 2020-24583Link to this heading#

\n

Incorrect permissions on intermediate-level directories on Python 3.7+. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

June 3, 2020 - CVE 2020-13596Link to this heading#

\n

Possible XSS via admin ForeignKeyRawIdWidget. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

June 3, 2020 - CVE 2020-13254Link to this heading#

\n

Potential data leakage via malformed memcached keys. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 4, 2020 - CVE 2020-9402Link to this heading#

\n

Potential SQL injection via tolerance parameter in GIS functions and\naggregates on Oracle. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 3, 2020 - CVE 2020-7471Link to this heading#

\n

Potential SQL injection via StringAgg(delimiter). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 18, 2019 - CVE 2019-19844Link to this heading#

\n

Potential account hijack via password reset form. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 2, 2019 - CVE 2019-19118Link to this heading#

\n

Privilege escalation in the Django admin. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14235Link to this heading#

\n

Potential memory exhaustion in django.utils.encoding.uri_to_iri(). Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14234Link to this heading#

\n

SQL injection possibility in key and index lookups for\nJSONField/HStoreField. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14233Link to this heading#

\n

Denial-of-service possibility in strip_tags(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 1, 2019 - CVE 2019-14232Link to this heading#

\n

Denial-of-service possibility in django.utils.text.Truncator.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 1, 2019 - CVE 2019-12781Link to this heading#

\n

Incorrect HTTP detection with reverse-proxy connecting via HTTPS.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

June 3, 2019 - CVE 2019-12308Link to this heading#

\n

XSS via «Current URL» link generated by AdminURLFieldWidget.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

June 3, 2019 - CVE 2019-11358Link to this heading#

\n

Prototype pollution in bundled jQuery. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 11, 2019 - CVE 2019-6975Link to this heading#

\n

Memory exhaustion in django.utils.numberformat.format(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 4, 2019 - CVE 2019-3498Link to this heading#

\n

Content spoofing possibility in the default 404 page. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

October 1, 2018 - CVE 2018-16984Link to this heading#

\n

Password hash disclosure to «view only» admin users. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 1, 2018 - CVE 2018-14574Link to this heading#

\n

Open redirect possibility in CommonMiddleware. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 6, 2018 - CVE 2018-7537Link to this heading#

\n

Denial-of-service possibility in truncatechars_html and\ntruncatewords_html template filters. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 6, 2018 - CVE 2018-7536Link to this heading#

\n

Denial-of-service possibility in urlize and urlizetrunc template\nfilters. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 1, 2018 - CVE 2018-6188Link to this heading#

\n

Information leakage in AuthenticationForm. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 5, 2017 - CVE 2017-12794Link to this heading#

\n

Possible XSS in traceback section of technical 500 debug page.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 4, 2017 - CVE 2017-7234Link to this heading#

\n

Open redirect vulnerability in django.views.static.serve().\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 4, 2017 - CVE 2017-7233Link to this heading#

\n

Open redirect and possible XSS attack via user-supplied numeric redirect URLs.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

November 1, 2016 - CVE 2016-9014Link to this heading#

\n

DNS rebinding vulnerability when DEBUG=True. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

November 1, 2016 - CVE 2016-9013Link to this heading#

\n

User with hardcoded password created when running tests on Oracle.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 26, 2016 - CVE 2016-7401Link to this heading#

\n

CSRF protection bypass on a site with Google Analytics. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 18, 2016 - CVE 2016-6186Link to this heading#

\n

XSS in admin’s add/change related popup. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 1, 2016 - CVE 2016-2513Link to this heading#

\n

User enumeration through timing difference on password hasher work factor\nupgrade. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 1, 2016 - CVE 2016-2512Link to this heading#

\n

Malicious redirect and possible XSS attack via user-supplied redirect URLs\ncontaining basic auth. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 1, 2016 - CVE 2016-2048Link to this heading#

\n

User with «change» but not «add» permission can create objects for\nModelAdmin’s with save_as=True. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

November 24, 2015 - CVE 2015-8213Link to this heading#

\n

Settings leak possibility in date template filter. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 18, 2015 - CVE 2015-5963 / CVE 2015-5964Link to this heading#

\n

Denial-of-service possibility in logout() view by filling session store.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5145Link to this heading#

\n

Denial-of-service possibility in URL validation. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5144Link to this heading#

\n

Header injection possibility since validators accept newlines in input.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 8, 2015 - CVE 2015-5143Link to this heading#

\n

Denial-of-service possibility by filling session store.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

May 20, 2015 - CVE 2015-3982Link to this heading#

\n

Fixed session flushing in the cached_db backend. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 18, 2015 - CVE 2015-2317Link to this heading#

\n

Mitigated possible XSS attack via user-supplied redirect URLs.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 18, 2015 - CVE 2015-2316Link to this heading#

\n

Denial-of-service possibility with strip_tags(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

March 9, 2015 - CVE 2015-2241Link to this heading#

\n

XSS attack via properties in ModelAdmin.readonly_fields. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0222Link to this heading#

\n

Database denial-of-service with ModelMultipleChoiceField. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0221Link to this heading#

\n

Denial-of-service attack against django.views.static.serve(). Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0220Link to this heading#

\n

Mitigated possible XSS attack via user-supplied redirect URLs. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

January 13, 2015 - CVE 2015-0219Link to this heading#

\n

WSGI header spoofing via underscore/dash conflation. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0483Link to this heading#

\n

Data leakage via querystring manipulation in admin.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0482Link to this heading#

\n

RemoteUserMiddleware session hijacking. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0481Link to this heading#

\n

File upload denial of service. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 20, 2014 - CVE 2014-0480Link to this heading#

\n

reverse() can generate URLs pointing to other hosts. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

May 18, 2014 - CVE 2014-3730Link to this heading#

\n

Malformed URLs from user input incorrectly validated. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

May 18, 2014 - CVE 2014-1418Link to this heading#

\n

Caches may be allowed to store and serve private data. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0474Link to this heading#

\n

MySQL typecasting causes unexpected query results. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0473Link to this heading#

\n

Caching of anonymous pages could reveal CSRF token. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

April 21, 2014 - CVE 2014-0472Link to this heading#

\n

Unexpected code execution using reverse(). Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 14, 2013 - CVE 2013-1443Link to this heading#

\n

Denial-of-service via large passwords. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 10, 2013 - CVE 2013-4315Link to this heading#

\n

Directory-traversal via ssi template tag. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 13, 2013 - CVE 2013-6044Link to this heading#

\n

Possible XSS via unvalidated URL redirect schemes. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 13, 2013 - CVE 2013-4249Link to this heading#

\n

XSS via admin trusting URLField values. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-0306Link to this heading#

\n

Denial-of-service via formset max_num bypass. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-0305Link to this heading#

\n

Information leakage via admin history log. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - CVE 2013-1664 / CVE 2013-1665Link to this heading#

\n

Entity-based attacks against Python XML libraries. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 19, 2013 - No CVELink to this heading#

\n

Additional hardening of Host header handling. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 10, 2012 - No CVE 2Link to this heading#

\n

Additional hardening of redirect validation. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 10, 2012 - No CVE 1Link to this heading#

\n

Additional hardening of Host header handling. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

October 17, 2012 - CVE 2012-4520Link to this heading#

\n

Host header poisoning. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3444Link to this heading#

\n

Denial-of-service via large image files. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3443Link to this heading#

\n

Denial-of-service via compressed image files. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 30, 2012 - CVE 2012-3442Link to this heading#

\n

XSS via failure to validate redirect scheme. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4140Link to this heading#

\n

Potential CSRF via Host header. Full description

\n
\n

Versions affectedLink to this heading#

\n

This notification was an advisory only, so no patches were issued.

\n
    \n

  • Django 1.2

    • \n

  • Django 1.3

    • \n
\n
\n
\n
\n

September 9, 2011 - CVE 2011-4139Link to this heading#

\n

Host header cache poisoning. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4138Link to this heading#

\n

Information leakage/arbitrary request issuance via URLField.verify_exists.\nFull description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4137Link to this heading#

\n

Denial-of-service via URLField.verify_exists. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 9, 2011 - CVE 2011-4136Link to this heading#

\n

Session manipulation when using memory-cache-backed session. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0698Link to this heading#

\n

Directory-traversal on Windows via incorrect path-separator handling. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0697Link to this heading#

\n

XSS via unsanitized names of uploaded files. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

February 8, 2011 - CVE 2011-0696Link to this heading#

\n

CSRF via forged HTTP headers. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 22, 2010 - CVE 2010-4535Link to this heading#

\n

Denial-of-service in password-reset mechanism. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

December 22, 2010 - CVE 2010-4534Link to this heading#

\n

Information leakage in administrative interface. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 8, 2010 - CVE 2010-3082Link to this heading#

\n

XSS via trusting unsafe cookie value. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

October 9, 2009 - CVE 2009-3695Link to this heading#

\n

Denial-of-service via pathological regular expression performance. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

July 28, 2009 - CVE 2009-2659Link to this heading#

\n

Directory-traversal in development server media handler. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

September 2, 2008 - CVE 2008-3909Link to this heading#

\n

CSRF via preservation of POST data during admin login. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

May 14, 2008 - CVE 2008-2302Link to this heading#

\n

XSS via admin login redirect. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

October 26, 2007 - CVE 2007-5712Link to this heading#

\n

Denial-of-service via arbitrarily-large Accept-Language header. Full\ndescription

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n
\n

Issues prior to Django’s security processLink to this heading#

\n

Some security issues were handled before Django had a formalized\nsecurity process in use. For these, new releases may not have been\nissued at the time and CVEs may not have been assigned.

\n
\n

January 21, 2007 - CVE 2007-0405Link to this heading#

\n

Apparent «caching» of authenticated user. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
\n

August 16, 2006 - CVE 2007-0404Link to this heading#

\n

Filename validation issue in translation framework. Full description

\n
\n

Versions affectedLink to this heading#

\n\n
\n
\n
","rootId":"archive-of-security-issues","toc":[{"title":"Issues under Django’s security process","anchor":"issues-under-django-s-security-process","children":[{"title":"August 4, 2026 - CVE 2026-15307","anchor":"august-4-2026-cve-2026-15307","children":[]},{"title":"August 4, 2026 - CVE 2026-15337","anchor":"august-4-2026-cve-2026-15337","children":[]},{"title":"August 4, 2026 - CVE 2026-15830","anchor":"august-4-2026-cve-2026-15830","children":[]},{"title":"August 4, 2026 - CVE 2026-15920","anchor":"august-4-2026-cve-2026-15920","children":[]},{"title":"July 7, 2026 - CVE 2026-48588","anchor":"july-7-2026-cve-2026-48588","children":[]},{"title":"July 7, 2026 - CVE 2026-53877","anchor":"july-7-2026-cve-2026-53877","children":[]},{"title":"July 7, 2026 - CVE 2026-53878","anchor":"july-7-2026-cve-2026-53878","children":[]},{"title":"June 3, 2026 - CVE 2026-6873","anchor":"june-3-2026-cve-2026-6873","children":[]},{"title":"June 3, 2026 - CVE 2026-7666","anchor":"june-3-2026-cve-2026-7666","children":[]},{"title":"June 3, 2026 - CVE 2026-8404","anchor":"june-3-2026-cve-2026-8404","children":[]},{"title":"June 3, 2026 - CVE 2026-35193","anchor":"june-3-2026-cve-2026-35193","children":[]},{"title":"June 3, 2026 - CVE 2026-48587","anchor":"june-3-2026-cve-2026-48587","children":[]},{"title":"May 5, 2026 - CVE 2026-5766","anchor":"may-5-2026-cve-2026-5766","children":[]},{"title":"May 5, 2026 - CVE 2026-35192","anchor":"may-5-2026-cve-2026-35192","children":[]},{"title":"May 5, 2026 - CVE 2026-6907","anchor":"may-5-2026-cve-2026-6907","children":[]},{"title":"April 7, 2026 - CVE 2026-3902","anchor":"april-7-2026-cve-2026-3902","children":[]},{"title":"April 7, 2026 - CVE 2026-4277","anchor":"april-7-2026-cve-2026-4277","children":[]},{"title":"April 7, 2026 - CVE 2026-4292","anchor":"april-7-2026-cve-2026-4292","children":[]},{"title":"April 7, 2026 - CVE 2026-33033","anchor":"april-7-2026-cve-2026-33033","children":[]},{"title":"April 7, 2026 - CVE 2026-33034","anchor":"april-7-2026-cve-2026-33034","children":[]},{"title":"March 3, 2026 - CVE 2026-25673","anchor":"march-3-2026-cve-2026-25673","children":[]},{"title":"March 3, 2026 - CVE 2026-25674","anchor":"march-3-2026-cve-2026-25674","children":[]},{"title":"February 3, 2026 - CVE 2025-13473","anchor":"february-3-2026-cve-2025-13473","children":[]},{"title":"February 3, 2026 - CVE 2025-14550","anchor":"february-3-2026-cve-2025-14550","children":[]},{"title":"February 3, 2026 - CVE 2026-1207","anchor":"february-3-2026-cve-2026-1207","children":[]},{"title":"February 3, 2026 - CVE 2026-1285","anchor":"february-3-2026-cve-2026-1285","children":[]},{"title":"February 3, 2026 - CVE 2026-1287","anchor":"february-3-2026-cve-2026-1287","children":[]},{"title":"February 3, 2026 - CVE 2026-1312","anchor":"february-3-2026-cve-2026-1312","children":[]},{"title":"December 2, 2025 - CVE 2025-13372","anchor":"december-2-2025-cve-2025-13372","children":[]},{"title":"December 2, 2025 - CVE 2025-64460","anchor":"december-2-2025-cve-2025-64460","children":[]},{"title":"November 5, 2025 - CVE 2025-64458","anchor":"november-5-2025-cve-2025-64458","children":[]},{"title":"November 5, 2025 - CVE 2025-64459","anchor":"november-5-2025-cve-2025-64459","children":[]},{"title":"October 1, 2025 - CVE 2025-59681","anchor":"october-1-2025-cve-2025-59681","children":[]},{"title":"October 1, 2025 - CVE 2025-59682","anchor":"october-1-2025-cve-2025-59682","children":[]},{"title":"September 3, 2025 - CVE 2025-57833","anchor":"september-3-2025-cve-2025-57833","children":[]},{"title":"June 4, 2025 - CVE 2025-48432","anchor":"june-4-2025-cve-2025-48432","children":[]},{"title":"May 7, 2025 - CVE 2025-32873","anchor":"may-7-2025-cve-2025-32873","children":[]},{"title":"April 2, 2025 - CVE 2025-27556","anchor":"april-2-2025-cve-2025-27556","children":[]},{"title":"March 6, 2025 - CVE 2025-26699","anchor":"march-6-2025-cve-2025-26699","children":[]},{"title":"January 14, 2025 - CVE 2024-56374","anchor":"january-14-2025-cve-2024-56374","children":[]},{"title":"December 4, 2024 - CVE 2024-53907","anchor":"december-4-2024-cve-2024-53907","children":[]},{"title":"December 4, 2024 - CVE 2024-53908","anchor":"december-4-2024-cve-2024-53908","children":[]},{"title":"September 3, 2024 - CVE 2024-45231","anchor":"september-3-2024-cve-2024-45231","children":[]},{"title":"September 3, 2024 - CVE 2024-45230","anchor":"september-3-2024-cve-2024-45230","children":[]},{"title":"August 6, 2024 - CVE 2024-42005","anchor":"august-6-2024-cve-2024-42005","children":[]},{"title":"August 6, 2024 - CVE 2024-41991","anchor":"august-6-2024-cve-2024-41991","children":[]},{"title":"August 6, 2024 - CVE 2024-41990","anchor":"august-6-2024-cve-2024-41990","children":[]},{"title":"August 6, 2024 - CVE 2024-41989","anchor":"august-6-2024-cve-2024-41989","children":[]},{"title":"July 9, 2024 - CVE 2024-39614","anchor":"july-9-2024-cve-2024-39614","children":[]},{"title":"July 9, 2024 - CVE 2024-39330","anchor":"july-9-2024-cve-2024-39330","children":[]},{"title":"July 9, 2024 - CVE 2024-39329","anchor":"july-9-2024-cve-2024-39329","children":[]},{"title":"July 9, 2024 - CVE 2024-38875","anchor":"july-9-2024-cve-2024-38875","children":[]},{"title":"March 4, 2024 - CVE 2024-27351","anchor":"march-4-2024-cve-2024-27351","children":[]},{"title":"February 6, 2024 - CVE 2024-24680","anchor":"february-6-2024-cve-2024-24680","children":[]},{"title":"November 1, 2023 - CVE 2023-46695","anchor":"november-1-2023-cve-2023-46695","children":[]},{"title":"October 4, 2023 - CVE 2023-43665","anchor":"october-4-2023-cve-2023-43665","children":[]},{"title":"September 4, 2023 - CVE 2023-41164","anchor":"september-4-2023-cve-2023-41164","children":[]},{"title":"July 3, 2023 - CVE 2023-36053","anchor":"july-3-2023-cve-2023-36053","children":[]},{"title":"May 3, 2023 - CVE 2023-31047","anchor":"may-3-2023-cve-2023-31047","children":[]},{"title":"February 14, 2023 - CVE 2023-24580","anchor":"february-14-2023-cve-2023-24580","children":[]},{"title":"February 1, 2023 - CVE 2023-23969","anchor":"february-1-2023-cve-2023-23969","children":[]},{"title":"October 4, 2022 - CVE 2022-41323","anchor":"october-4-2022-cve-2022-41323","children":[]},{"title":"August 3, 2022 - CVE 2022-36359","anchor":"august-3-2022-cve-2022-36359","children":[]},{"title":"July 4, 2022 - CVE 2022-34265","anchor":"july-4-2022-cve-2022-34265","children":[]},{"title":"April 11, 2022 - CVE 2022-28346","anchor":"april-11-2022-cve-2022-28346","children":[]},{"title":"April 11, 2022 - CVE 2022-28347","anchor":"april-11-2022-cve-2022-28347","children":[]},{"title":"February 1, 2022 - CVE 2022-22818","anchor":"february-1-2022-cve-2022-22818","children":[{"title":"Versions affected","anchor":"versions-affected","children":[]}]},{"title":"February 1, 2022 - CVE 2022-23833","anchor":"february-1-2022-cve-2022-23833","children":[{"title":"Versions affected","anchor":"id1","children":[]}]},{"title":"January 4, 2022 - CVE 2021-45452","anchor":"january-4-2022-cve-2021-45452","children":[{"title":"Versions affected","anchor":"id2","children":[]}]},{"title":"January 4, 2022 - CVE 2021-45116","anchor":"january-4-2022-cve-2021-45116","children":[{"title":"Versions affected","anchor":"id3","children":[]}]},{"title":"January 4, 2022 - CVE 2021-45115","anchor":"january-4-2022-cve-2021-45115","children":[{"title":"Versions affected","anchor":"id4","children":[]}]},{"title":"December 7, 2021 - CVE 2021-44420","anchor":"december-7-2021-cve-2021-44420","children":[{"title":"Versions affected","anchor":"id5","children":[]}]},{"title":"July 1, 2021 - CVE 2021-35042","anchor":"july-1-2021-cve-2021-35042","children":[{"title":"Versions affected","anchor":"id6","children":[]}]},{"title":"June 2, 2021 - CVE 2021-33203","anchor":"june-2-2021-cve-2021-33203","children":[{"title":"Versions affected","anchor":"id7","children":[]}]},{"title":"June 2, 2021 - CVE 2021-33571","anchor":"june-2-2021-cve-2021-33571","children":[{"title":"Versions affected","anchor":"id8","children":[]}]},{"title":"May 6, 2021 - CVE 2021-32052","anchor":"may-6-2021-cve-2021-32052","children":[{"title":"Versions affected","anchor":"id9","children":[]}]},{"title":"May 4, 2021 - CVE 2021-31542","anchor":"may-4-2021-cve-2021-31542","children":[{"title":"Versions affected","anchor":"id10","children":[]}]},{"title":"April 6, 2021 - CVE 2021-28658","anchor":"april-6-2021-cve-2021-28658","children":[{"title":"Versions affected","anchor":"id11","children":[]}]},{"title":"February 19, 2021 - CVE 2021-23336","anchor":"february-19-2021-cve-2021-23336","children":[{"title":"Versions affected","anchor":"id12","children":[]}]},{"title":"February 1, 2021 - CVE 2021-3281","anchor":"february-1-2021-cve-2021-3281","children":[{"title":"Versions affected","anchor":"id13","children":[]}]},{"title":"September 1, 2020 - CVE 2020-24584","anchor":"september-1-2020-cve-2020-24584","children":[{"title":"Versions affected","anchor":"id14","children":[]}]},{"title":"September 1, 2020 - CVE 2020-24583","anchor":"september-1-2020-cve-2020-24583","children":[{"title":"Versions affected","anchor":"id15","children":[]}]},{"title":"June 3, 2020 - CVE 2020-13596","anchor":"june-3-2020-cve-2020-13596","children":[{"title":"Versions affected","anchor":"id16","children":[]}]},{"title":"June 3, 2020 - CVE 2020-13254","anchor":"june-3-2020-cve-2020-13254","children":[{"title":"Versions affected","anchor":"id17","children":[]}]},{"title":"March 4, 2020 - CVE 2020-9402","anchor":"march-4-2020-cve-2020-9402","children":[{"title":"Versions affected","anchor":"id18","children":[]}]},{"title":"February 3, 2020 - CVE 2020-7471","anchor":"february-3-2020-cve-2020-7471","children":[{"title":"Versions affected","anchor":"id19","children":[]}]},{"title":"December 18, 2019 - CVE 2019-19844","anchor":"december-18-2019-cve-2019-19844","children":[{"title":"Versions affected","anchor":"id20","children":[]}]},{"title":"December 2, 2019 - CVE 2019-19118","anchor":"december-2-2019-cve-2019-19118","children":[{"title":"Versions affected","anchor":"id21","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14235","anchor":"august-1-2019-cve-2019-14235","children":[{"title":"Versions affected","anchor":"id22","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14234","anchor":"august-1-2019-cve-2019-14234","children":[{"title":"Versions affected","anchor":"id23","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14233","anchor":"august-1-2019-cve-2019-14233","children":[{"title":"Versions affected","anchor":"id24","children":[]}]},{"title":"August 1, 2019 - CVE 2019-14232","anchor":"august-1-2019-cve-2019-14232","children":[{"title":"Versions affected","anchor":"id25","children":[]}]},{"title":"July 1, 2019 - CVE 2019-12781","anchor":"july-1-2019-cve-2019-12781","children":[{"title":"Versions affected","anchor":"id26","children":[]}]},{"title":"June 3, 2019 - CVE 2019-12308","anchor":"june-3-2019-cve-2019-12308","children":[{"title":"Versions affected","anchor":"id27","children":[]}]},{"title":"June 3, 2019 - CVE 2019-11358","anchor":"june-3-2019-cve-2019-11358","children":[{"title":"Versions affected","anchor":"id28","children":[]}]},{"title":"February 11, 2019 - CVE 2019-6975","anchor":"february-11-2019-cve-2019-6975","children":[{"title":"Versions affected","anchor":"id29","children":[]}]},{"title":"January 4, 2019 - CVE 2019-3498","anchor":"january-4-2019-cve-2019-3498","children":[{"title":"Versions affected","anchor":"id30","children":[]}]},{"title":"October 1, 2018 - CVE 2018-16984","anchor":"october-1-2018-cve-2018-16984","children":[{"title":"Versions affected","anchor":"id31","children":[]}]},{"title":"August 1, 2018 - CVE 2018-14574","anchor":"august-1-2018-cve-2018-14574","children":[{"title":"Versions affected","anchor":"id32","children":[]}]},{"title":"March 6, 2018 - CVE 2018-7537","anchor":"march-6-2018-cve-2018-7537","children":[{"title":"Versions affected","anchor":"id33","children":[]}]},{"title":"March 6, 2018 - CVE 2018-7536","anchor":"march-6-2018-cve-2018-7536","children":[{"title":"Versions affected","anchor":"id34","children":[]}]},{"title":"February 1, 2018 - CVE 2018-6188","anchor":"february-1-2018-cve-2018-6188","children":[{"title":"Versions affected","anchor":"id35","children":[]}]},{"title":"September 5, 2017 - CVE 2017-12794","anchor":"september-5-2017-cve-2017-12794","children":[{"title":"Versions affected","anchor":"id36","children":[]}]},{"title":"April 4, 2017 - CVE 2017-7234","anchor":"april-4-2017-cve-2017-7234","children":[{"title":"Versions affected","anchor":"id37","children":[]}]},{"title":"April 4, 2017 - CVE 2017-7233","anchor":"april-4-2017-cve-2017-7233","children":[{"title":"Versions affected","anchor":"id38","children":[]}]},{"title":"November 1, 2016 - CVE 2016-9014","anchor":"november-1-2016-cve-2016-9014","children":[{"title":"Versions affected","anchor":"id39","children":[]}]},{"title":"November 1, 2016 - CVE 2016-9013","anchor":"november-1-2016-cve-2016-9013","children":[{"title":"Versions affected","anchor":"id40","children":[]}]},{"title":"September 26, 2016 - CVE 2016-7401","anchor":"september-26-2016-cve-2016-7401","children":[{"title":"Versions affected","anchor":"id41","children":[]}]},{"title":"July 18, 2016 - CVE 2016-6186","anchor":"july-18-2016-cve-2016-6186","children":[{"title":"Versions affected","anchor":"id42","children":[]}]},{"title":"March 1, 2016 - CVE 2016-2513","anchor":"march-1-2016-cve-2016-2513","children":[{"title":"Versions affected","anchor":"id43","children":[]}]},{"title":"March 1, 2016 - CVE 2016-2512","anchor":"march-1-2016-cve-2016-2512","children":[{"title":"Versions affected","anchor":"id44","children":[]}]},{"title":"February 1, 2016 - CVE 2016-2048","anchor":"february-1-2016-cve-2016-2048","children":[{"title":"Versions affected","anchor":"id45","children":[]}]},{"title":"November 24, 2015 - CVE 2015-8213","anchor":"november-24-2015-cve-2015-8213","children":[{"title":"Versions affected","anchor":"id46","children":[]}]},{"title":"August 18, 2015 - CVE 2015-5963 / CVE 2015-5964","anchor":"august-18-2015-cve-2015-5963-cve-2015-5964","children":[{"title":"Versions affected","anchor":"id47","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5145","anchor":"july-8-2015-cve-2015-5145","children":[{"title":"Versions affected","anchor":"id48","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5144","anchor":"july-8-2015-cve-2015-5144","children":[{"title":"Versions affected","anchor":"id49","children":[]}]},{"title":"July 8, 2015 - CVE 2015-5143","anchor":"july-8-2015-cve-2015-5143","children":[{"title":"Versions affected","anchor":"id50","children":[]}]},{"title":"May 20, 2015 - CVE 2015-3982","anchor":"may-20-2015-cve-2015-3982","children":[{"title":"Versions affected","anchor":"id51","children":[]}]},{"title":"March 18, 2015 - CVE 2015-2317","anchor":"march-18-2015-cve-2015-2317","children":[{"title":"Versions affected","anchor":"id52","children":[]}]},{"title":"March 18, 2015 - CVE 2015-2316","anchor":"march-18-2015-cve-2015-2316","children":[{"title":"Versions affected","anchor":"id53","children":[]}]},{"title":"March 9, 2015 - CVE 2015-2241","anchor":"march-9-2015-cve-2015-2241","children":[{"title":"Versions affected","anchor":"id54","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0222","anchor":"january-13-2015-cve-2015-0222","children":[{"title":"Versions affected","anchor":"id55","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0221","anchor":"january-13-2015-cve-2015-0221","children":[{"title":"Versions affected","anchor":"id56","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0220","anchor":"january-13-2015-cve-2015-0220","children":[{"title":"Versions affected","anchor":"id57","children":[]}]},{"title":"January 13, 2015 - CVE 2015-0219","anchor":"january-13-2015-cve-2015-0219","children":[{"title":"Versions affected","anchor":"id58","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0483","anchor":"august-20-2014-cve-2014-0483","children":[{"title":"Versions affected","anchor":"id59","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0482","anchor":"august-20-2014-cve-2014-0482","children":[{"title":"Versions affected","anchor":"id60","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0481","anchor":"august-20-2014-cve-2014-0481","children":[{"title":"Versions affected","anchor":"id61","children":[]}]},{"title":"August 20, 2014 - CVE 2014-0480","anchor":"august-20-2014-cve-2014-0480","children":[{"title":"Versions affected","anchor":"id62","children":[]}]},{"title":"May 18, 2014 - CVE 2014-3730","anchor":"may-18-2014-cve-2014-3730","children":[{"title":"Versions affected","anchor":"id63","children":[]}]},{"title":"May 18, 2014 - CVE 2014-1418","anchor":"may-18-2014-cve-2014-1418","children":[{"title":"Versions affected","anchor":"id64","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0474","anchor":"april-21-2014-cve-2014-0474","children":[{"title":"Versions affected","anchor":"id65","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0473","anchor":"april-21-2014-cve-2014-0473","children":[{"title":"Versions affected","anchor":"id66","children":[]}]},{"title":"April 21, 2014 - CVE 2014-0472","anchor":"april-21-2014-cve-2014-0472","children":[{"title":"Versions affected","anchor":"id67","children":[]}]},{"title":"September 14, 2013 - CVE 2013-1443","anchor":"september-14-2013-cve-2013-1443","children":[{"title":"Versions affected","anchor":"id68","children":[]}]},{"title":"September 10, 2013 - CVE 2013-4315","anchor":"september-10-2013-cve-2013-4315","children":[{"title":"Versions affected","anchor":"id69","children":[]}]},{"title":"August 13, 2013 - CVE 2013-6044","anchor":"august-13-2013-cve-2013-6044","children":[{"title":"Versions affected","anchor":"id70","children":[]}]},{"title":"August 13, 2013 - CVE 2013-4249","anchor":"august-13-2013-cve-2013-4249","children":[{"title":"Versions affected","anchor":"id71","children":[]}]},{"title":"February 19, 2013 - CVE 2013-0306","anchor":"february-19-2013-cve-2013-0306","children":[{"title":"Versions affected","anchor":"id72","children":[]}]},{"title":"February 19, 2013 - CVE 2013-0305","anchor":"february-19-2013-cve-2013-0305","children":[{"title":"Versions affected","anchor":"id73","children":[]}]},{"title":"February 19, 2013 - CVE 2013-1664 / CVE 2013-1665","anchor":"february-19-2013-cve-2013-1664-cve-2013-1665","children":[{"title":"Versions affected","anchor":"id74","children":[]}]},{"title":"February 19, 2013 - No CVE","anchor":"february-19-2013-no-cve","children":[{"title":"Versions affected","anchor":"id75","children":[]}]},{"title":"December 10, 2012 - No CVE 2","anchor":"december-10-2012-no-cve-2","children":[{"title":"Versions affected","anchor":"id76","children":[]}]},{"title":"December 10, 2012 - No CVE 1","anchor":"december-10-2012-no-cve-1","children":[{"title":"Versions affected","anchor":"id77","children":[]}]},{"title":"October 17, 2012 - CVE 2012-4520","anchor":"october-17-2012-cve-2012-4520","children":[{"title":"Versions affected","anchor":"id78","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3444","anchor":"july-30-2012-cve-2012-3444","children":[{"title":"Versions affected","anchor":"id79","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3443","anchor":"july-30-2012-cve-2012-3443","children":[{"title":"Versions affected","anchor":"id80","children":[]}]},{"title":"July 30, 2012 - CVE 2012-3442","anchor":"july-30-2012-cve-2012-3442","children":[{"title":"Versions affected","anchor":"id81","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4140","anchor":"september-9-2011-cve-2011-4140","children":[{"title":"Versions affected","anchor":"id82","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4139","anchor":"september-9-2011-cve-2011-4139","children":[{"title":"Versions affected","anchor":"id83","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4138","anchor":"september-9-2011-cve-2011-4138","children":[{"title":"Versions affected","anchor":"id84","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4137","anchor":"september-9-2011-cve-2011-4137","children":[{"title":"Versions affected","anchor":"id85","children":[]}]},{"title":"September 9, 2011 - CVE 2011-4136","anchor":"september-9-2011-cve-2011-4136","children":[{"title":"Versions affected","anchor":"id86","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0698","anchor":"february-8-2011-cve-2011-0698","children":[{"title":"Versions affected","anchor":"id87","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0697","anchor":"february-8-2011-cve-2011-0697","children":[{"title":"Versions affected","anchor":"id88","children":[]}]},{"title":"February 8, 2011 - CVE 2011-0696","anchor":"february-8-2011-cve-2011-0696","children":[{"title":"Versions affected","anchor":"id89","children":[]}]},{"title":"December 22, 2010 - CVE 2010-4535","anchor":"december-22-2010-cve-2010-4535","children":[{"title":"Versions affected","anchor":"id90","children":[]}]},{"title":"December 22, 2010 - CVE 2010-4534","anchor":"december-22-2010-cve-2010-4534","children":[{"title":"Versions affected","anchor":"id91","children":[]}]},{"title":"September 8, 2010 - CVE 2010-3082","anchor":"september-8-2010-cve-2010-3082","children":[{"title":"Versions affected","anchor":"id92","children":[]}]},{"title":"October 9, 2009 - CVE 2009-3695","anchor":"october-9-2009-cve-2009-3695","children":[{"title":"Versions affected","anchor":"id93","children":[]}]},{"title":"July 28, 2009 - CVE 2009-2659","anchor":"july-28-2009-cve-2009-2659","children":[{"title":"Versions affected","anchor":"id94","children":[]}]},{"title":"September 2, 2008 - CVE 2008-3909","anchor":"september-2-2008-cve-2008-3909","children":[{"title":"Versions affected","anchor":"id95","children":[]}]},{"title":"May 14, 2008 - CVE 2008-2302","anchor":"may-14-2008-cve-2008-2302","children":[{"title":"Versions affected","anchor":"id96","children":[]}]},{"title":"October 26, 2007 - CVE 2007-5712","anchor":"october-26-2007-cve-2007-5712","children":[{"title":"Versions affected","anchor":"id97","children":[]}]}]},{"title":"Issues prior to Django’s security process","anchor":"issues-prior-to-django-s-security-process","children":[{"title":"January 21, 2007 - CVE 2007-0405","anchor":"january-21-2007-cve-2007-0405","children":[{"title":"Versions affected","anchor":"id98","children":[]}]},{"title":"August 16, 2006 - CVE 2007-0404","anchor":"august-16-2006-cve-2007-0404","children":[{"title":"Versions affected","anchor":"id99","children":[]}]}]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/es/6.0/releases/"}],"prev":{"docname":"releases/0.95","title":"Django version 0.95 release notes","url":"/es/6.0/releases/0.95/"},"next":{"docname":"internals/index","title":"Django internals","url":"/es/6.0/internals/"},"formats":{"html":"/es/6.0/releases/security/","markdown":"/es/6.0/releases/security.md","json":"/es/6.0/releases/security.json"},"source":"https://github.com/django/django/blob/stable/6.0.x/docs/releases/security.txt","official":"https://docs.djangoproject.com/es/6.0/releases/security/","inVersions":["6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9"],"inLocales":["en","sv","zh-hans","ga","fr","ja","id","it","pt-br","ko","es","el","pl"]}