Package: python-django Version: 2:2.2.28-1~deb11u13 X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for python-django: * CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant(). django.utils.translation.get_supported_language_variant() was subject to a potential denial-of-service attack when processing many distinct, very long language codes. Language codes were used as keys in an in-memory cache before their length was limited, potentially consuming excessive process memory. [0] * CVE-2026-84429: Potential denial-of-service vulnerability in HTTP header parsing. django.utils.http.parse_header_parameters() was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as Accept or Content-Type, for instance via the content negotiation performed by HttpRequest.accepts(). The per-call length limit does not bound the combined size of repeated headers. The undocumented django.utils.http.parse_header_parameters() function now uses Python's email.message.Message for parsing. As a result, parsing of some malformed or unusual header values may differ, for example, RFC 2231 values with a missing encoding are now decoded. [1] * CVE-2026-87890: Potential request forgery via spatial lookup byte values. Spatial lookups accepted raster values provided as bytes without requiring them to be explicitly wrapped in django.contrib.gis.gdal.GDALRaster. Although these values were opened through GDAL's in-memory virtual filesystem, they could contain a VRT document referencing an external raster source. This could cause GDAL to issue network requests as the Django process user while preparing the lookup. This issue could be exploited by applications that passed attacker-controlled bytes directly to a spatial lookup. It was overlooked in the fix for CVE-2026-15307. To mitigate this issue, raster values provided as bytes must now be wrapped in GDALRaster before being used in spatial lookups. Byte values representing valid hexadecimal geometries remain accepted. [2] * CVE-2026-87975: Privilege abuse in model formsets with editable primary keys. Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model's primary key could be set through the form, such as with: a OneToOneField (or parent link used as the primary key of an inline formset's model), or a natural or UUID primary key included in the form's fields. Models using the default BigAutoField primary key were not affected. [3] For further information see upstream's blog post [4], as well as: [0] https://security-tracker.debian.org/tracker/CVE-2026-77050 https://www.cve.org/CVERecord?id=CVE-2026-77050 [1] https://security-tracker.debian.org/tracker/CVE-2026-84429 https://www.cve.org/CVERecord?id=CVE-2026-84429 [2] https://security-tracker.debian.org/tracker/CVE-2026-87890 https://www.cve.org/CVERecord?id=CVE-2026-87890 [3] https://security-tracker.debian.org/tracker/CVE-2026-87975 https://www.cve.org/CVERecord?id=CVE-2026-87975 [4] https://www.djangoproject.com/weblog/2026/oct/06/security-releases/ Regards, -- ,''`. : :' : Chris Lamb `. `'` [email protected] / chris-lamb.co.uk `-
