Django 4.2.30 release notesLien vers cette rubrique
April 7, 2026
Django 4.2.30 fixes one security issue with severity « moderate » and four security issues with severity « low » in 4.2.29.
CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflationLien vers cette rubrique
ASGIRequest normalizes header names following WSGI conventions, mapping
hyphens to underscores. As a result, even in configurations where reverse
proxies carefully strip security-sensitive headers named with hyphens, such a
header could be spoofed by supplying a header named with underscores.
Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous
mappings. (Django’s runserver was patched in CVE 2015-0219.) But
under ASGI, there is not the same uniform expectation, even if many proxies
protect against this under default configuration (including nginx via
underscores_in_headers off;).
Headers containing underscores are now ignored by ASGIRequest, matching the
behavior of Daphne, the reference server for ASGI.
La sévérité de cette faille est jugée comme « basse » selon la politique de sécurité de Django.
CVE-2026-4277: Privilege abuse in GenericInlineModelAdminLien vers cette rubrique
Add permissions on inline model instances were not validated on submission of
forged POST data in
GenericInlineModelAdmin.
La sévérité de cette faille est jugée comme « basse » selon la politique de sécurité de Django.
CVE-2026-4292: Privilege abuse in ModelAdmin.list_editableLien vers cette rubrique
Admin changelist forms using
list_editable incorrectly allowed new
instances to be created via forged POST data.
La sévérité de cette faille est jugée comme « basse » selon la politique de sécurité de Django.
CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploadLien vers cette rubrique
When using django.http.multipartparser.MultiPartParser, multipart uploads
with Content-Transfer-Encoding: base64 that include excessive whitespace
may trigger repeated memory copying, potentially degrading performance.
This issue has severity « moderate » according to the Django security policy.
CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypassLien vers cette rubrique
ASGI requests with a missing or understated Content-Length header could
bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading
HttpRequest.body, potentially loading an unbounded request body into
memory and causing service degradation.
La sévérité de cette faille est jugée comme « basse » selon la politique de sécurité de Django.