Django 4.2.28 release notesLien vers cette rubrique#

CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handlerLien vers cette rubrique#

The django.contrib.auth.handlers.modwsgi.check_password() function for authentication via mod_wsgi allowed remote attackers to enumerate users via a timing attack.

This issue has severity « low » according to the Django security policy.

CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGILien vers cette rubrique#

When receiving duplicates of a single header, ASGIRequest allowed a remote attacker to cause a potential denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-linear computation resulting in service degradation or outage.

This issue has severity « moderate » according to the Django security policy.

CVE-2026-1207: Potential SQL injection via raster lookups on PostGISLien vers cette rubrique#

Raster lookups on GIS fields (only implemented on PostGIS) were subject to SQL injection if untrusted data was used as a band index.

Pour rappel, toutes les données non fiables provenant des utilisateurs doivent être validées avant d’être réutilisées.

This issue has severity « high » according to the Django security policy.

CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methodsLien vers cette rubrique#

django.utils.text.Truncator.chars() and Truncator.words() methods (with html=True) and the truncatechars_html and truncatewords_html template filters were subject to a potential denial-of-service attack via certain inputs with a large number of unmatched HTML end tags, which could cause quadratic time complexity during HTML parsing.

This issue has severity « moderate » according to the Django security policy.

CVE-2026-1287: Potential SQL injection in column aliases via control charactersLien vers cette rubrique#

FilteredRelation was subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias().

This issue has severity « high » according to the Django security policy.

CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelationLien vers cette rubrique#

QuerySet.order_by() was subject to SQL injection in column aliases containing periods when the same alias was, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation.

This issue has severity « high » according to the Django security policy.