Vulnerabilities for Django

First version without a known vulnerability: 6.1a1

Details

• PYSEC-2026-37172026-08-04

  An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.

  Fixed in: 5.2.17, 6.0.8

• GHSA-3h9f-r86x-qvjx2026-07-07

  Django: cache middleware may expose private responses when unrelated request cookies are present

  Fixed in: 5.2.16, 6.0.7

• GHSA-8qcx-xf44-272x2026-07-07

  Django: DomainNameValidator permits newline characters that may enable HTTP header injection

  Fixed in: 5.2.16, 6.0.7

• GHSA-crhf-3pfg-w68w2026-07-07

  Django: GDALRaster may over-read heap memory when constructed from bytes

  Fixed in: 5.2.16, 6.0.7

• GHSA-8cjm-8mp7-r2xf2026-06-03

  Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

  Fixed in: 5.2.15, 6.0.6

• GHSA-923m-gv2p-w5qp2026-06-03

  Django: has_vary_header may expose cached responses when Vary values contain whitespace

  Fixed in: 5.2.15, 6.0.6

• GHSA-h7pc-vwp9-298g2026-06-03

  Django: signed cookies are vulnerable to salt namespace collisions

  Fixed in: 5.2.15, 6.0.6

• GHSA-mm6v-q8q9-pgcf2026-06-03

  Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

  Fixed in: 5.2.15, 6.0.6

• GHSA-qpc8-7fxc-cm4p2026-06-03

  Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary

  Fixed in: 5.2.15, 6.0.6

• GHSA-5hrc-gvxj-w55p2026-05-05

  Django Uses Cache Containing Sensitive Information

  Fixed in: 6.0.5, 5.2.14

• GHSA-w26r-rmm8-9c292026-05-05

  Django has an Improper Handling of Length Parameter Inconsistency

  Fixed in: 6.0.5, 5.2.14

• GHSA-7h2m-m8vj-598h2026-05-05

  Django Uses Persistent Cookies Containing Sensitive Information

  Fixed in: 6.0.5, 5.2.14

• GHSA-mmwr-2jhp-mc7j2026-04-07

  Django vulnerable to privilege abuse in ModelAdmin.list_editable

  Fixed in: 6.0.4, 5.2.13, 4.2.30

• GHSA-mvfq-ggxm-9mc52026-04-07

  Django vulnerable to ASGI header spoofing via underscore/hyphen conflation

  Fixed in: 6.0.4, 5.2.13, 4.2.30

• GHSA-pwjp-ccjc-ghwg2026-04-07

  Django vulnerable to privilege abuse in GenericInlineModelAdmin

  Fixed in: 6.0.4, 5.2.13, 4.2.30

• GHSA-5mf9-h53q-7mhq2026-04-07

  Django has potential DoS via MultiPartParser through crafted multipart uploads

  Fixed in: 6.0.4, 5.2.13, 4.2.30

• GHSA-933h-hp56-hf7m2026-04-07

  Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

  Fixed in: 6.0.4, 5.2.13, 4.2.30

• GHSA-8p8v-wh79-9r562026-03-03

  Django vulnerable to Uncontrolled Resource Consumption

  Fixed in: 6.0.3, 5.2.12, 4.2.29

• GHSA-mjgh-79qc-68w32026-03-03

  Django has a Race Condition vulnerability

  Fixed in: 6.0.3, 5.2.12, 4.2.29

• GHSA-6426-9fv3-65x82026-02-03

  Django has an SQL Injection issue

  Fixed in: 6.0.2, 5.2.11, 4.2.28

• GHSA-gvg8-93h5-g6qq2026-02-03

  Django has an SQL Injection issue

  Fixed in: 6.0.2, 5.2.11, 4.2.28

• GHSA-2mcm-79hx-8fxw2026-02-03

  Django has Observable Timing Discrepancy

  Fixed in: 6.0.2, 5.2.11, 4.2.28

• GHSA-33mw-q7rj-mjwj2026-02-03

  Django has Inefficient Algorithmic Complexity

  Fixed in: 6.0.2, 5.2.11, 4.2.28

• GHSA-4rrr-2h4v-f3j92026-02-03

  Django has Inefficient Algorithmic Complexity

  Fixed in: 6.0.2, 5.2.11, 4.2.28

• GHSA-mwm9-4648-f68q2026-02-03

  Django has an SQL Injection issue

  Fixed in: 6.0.2, 5.2.11, 4.2.28

• GHSA-rqw2-ghq9-44m72025-12-02

  Django is vulnerable to SQL injection in column aliases

  Fixed in: 5.2.9, 5.1.15, 4.2.27

• GHSA-vrcr-9hj9-jcg62025-12-02

  Django is vulnerable to DoS via XML serializer text extraction

  Fixed in: 5.2.9, 5.1.15, 4.2.27

• GHSA-frmv-pr5f-9mcr2025-11-05

  Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

  Fixed in: 5.2.8, 5.1.14, 4.2.26

• GHSA-qw25-v68c-qjf32025-11-05

  Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

  Fixed in: 5.2.8, 5.1.14, 4.2.26

• GHSA-q95w-c7qg-hrff2025-10-01

  Django vulnerable to partial directory traversal via archives

  Fixed in: 4.2.25, 5.1.13, 5.2.7

• GHSA-hpr9-3m2g-3j9p2025-10-01

  Django vulnerable to SQL injection in column aliases

  Fixed in: 4.2.25, 5.1.13, 5.2.7

• GHSA-6w2r-r2m5-xq5w2025-09-08

  Django is subject to SQL injection through its column aliases

  Fixed in: 4.2.24, 5.1.12, 5.2.6

• GHSA-7xr5-9hcq-chf92025-06-05

  Django Improper Output Neutralization for Logs vulnerability

  Fixed in: 5.2.2, 5.1.10, 4.2.22

• GHSA-8j24-cjrq-gr2m2025-05-08

  Django has a denial-of-service possibility in strip_tags()

  Fixed in: 4.2.21, 5.1.9, 5.2.1

• GHSA-wqfg-m96j-85vm2025-04-02

  Django Potential Denial of Service (DoS) on Windows

  Fixed in: 5.0.14, 5.1.8

• GHSA-p3fp-8748-vqfq2025-03-06

  Django vulnerable to Allocation of Resources Without Limits or Throttling

  Fixed in: 4.2.20, 5.0.13, 5.1.7

• GHSA-qcgg-j2x8-h9g82025-01-14

  Django has a potential denial-of-service vulnerability in IPv6 validation

  Fixed in: 5.1.5, 5.0.11, 4.2.18

• GHSA-8498-2h75-472j2024-12-06

  Django denial-of-service in django.utils.html.strip_tags()

  Fixed in: 5.1.4, 4.2.17, 5.0.10

• GHSA-m9g8-fxxm-xg862024-12-06

  Django SQL injection in HasKey(lhs, rhs) on Oracle

  Fixed in: 5.0.10, 5.1.4, 4.2.17

• GHSA-5hgc-2vfp-mqvc2024-10-08

  Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters

  Fixed in: 5.1.1, 5.0.9, 4.2.16

• GHSA-rrqc-c2jx-6jgv2024-10-08

  Django allows enumeration of user e-mail addresses

  Fixed in: 5.1.1, 5.0.9, 4.2.16

• GHSA-795c-9xpc-xw6g2024-08-07

  Django vulnerable to a denial-of-service attack

  Fixed in: 5.0.8, 4.2.15

• GHSA-jh75-99hh-qvx92024-08-07

  Django memory consumption vulnerability

  Fixed in: 5.0.8, 4.2.15

• GHSA-pv4p-cwwg-4rph2024-08-07

  Django SQL injection vulnerability

  Fixed in: 5.0.8, 4.2.15

• GHSA-r836-hh6v-rg5g2024-08-07

  Django vulnerable to denial-of-service attack

  Fixed in: 5.0.8, 4.2.15

• GHSA-9jmf-237g-qf462024-07-10

  Django Path Traversal vulnerability

  Fixed in: 5.0.7, 4.2.14

• GHSA-f6f8-9mx6-9mx22024-07-10

  Django vulnerable to Denial of Service

  Fixed in: 5.0.7, 4.2.14

• GHSA-qg2p-9jwr-mmqf2024-07-10

  Django vulnerable to Denial of Service

  Fixed in: 4.2.14, 5.0.7

• GHSA-x7q2-wr7g-xqmf2024-07-10

  Django vulnerable to user enumeration attack

  Fixed in: 5.0.7, 4.2.14

• GHSA-vm8q-m57g-pff32024-03-15

  Regular expression denial-of-service in Django

  Fixed in: 3.2.25, 4.2.11, 5.0.3

• GHSA-xxj9-f6rv-m3x42024-02-07

  Django denial-of-service attack in the intcomma template filter

  Fixed in: 3.2.24, 4.2.10, 5.0.2

• GHSA-h8gc-pgj2-vjm32023-11-03

  Django Denial-of-service in django.utils.text.Truncator

  Fixed in: 3.2.22, 4.1.12, 4.2.6

• GHSA-7h4p-27mh-hmrw2023-11-03

  Django Denial of service vulnerability in django.utils.encoding.uri_to_iri

  Fixed in: 3.2.21, 4.1.11, 4.2.5

• GHSA-qmf9-6jqf-j8fq2023-11-02

  Django potential denial of service vulnerability in UsernameField on Windows

  Fixed in: 3.2.23, 4.1.13, 4.2.7

• GHSA-jh3w-4vvf-mjgr2023-07-03

  Django has regular expression denial of service vulnerability in EmailValidator/URLValidator

  Fixed in: 3.2.20, 4.1.10, 4.2.3

• GHSA-r3xc-prgr-mg9p2023-05-07

  Django bypasses validation when using one form field to upload multiple files

  Fixed in: 3.2.19, 4.1.9, 4.2.1

• GHSA-2hrw-hx67-34x62023-02-15

  Resource exhaustion in Django

  Fixed in: 3.2.18, 4.1.7, 4.0.10

• GHSA-q2jf-h9jm-m7p42023-02-01

  Django contains Uncontrolled Resource Consumption via cached header

  Fixed in: 3.2.17, 4.0.9, 4.1.6

• GHSA-qrw5-5h28-6cmg2022-10-16

  Django denial-of-service vulnerability in internationalized URLs

  Fixed in: 3.2.16, 4.0.8, 4.1.2, 5b6b257fa7ec37ff27965358800c67e2dd11c924

• GHSA-8x94-hmjh-97hq2022-08-11

  Django vulnerable to Reflected File Download attack

  Fixed in: 3.2.15, 4.0.7

• GHSA-p64x-8rxx-wf6q2022-07-05

  Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

  Fixed in: 3.2.14, 4.0.6

• GHSA-59w8-4wm2-4xw82022-05-17

  Django Image Field Vulnerable to Image Decompression Bombs

  Fixed in: 1.3.2, 1.4.1

• GHSA-5h2q-4hrp-v9rr2022-05-17

  Django vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

  Fixed in: 1.3.2, 1.4.1

• GHSA-78vx-ggch-wghm2022-05-17

  Django Allows Redirect via Data URL

  Fixed in: 1.3.2, 1.4.1

• GHSA-2655-q453-22f92022-05-17

  Django Allows Arbitrary URL Generation

  Fixed in: 1.3.4, 1.4.2, 9305c0e12d43c4df999c3301a1f0c742264a657e, b45c377f8f488955e0c7069cad3f3dd21910b071, 92d3430f12171f16f566c9050c40feefb830a4a3

• GHSA-qrh7-x6fp-c2mp2022-05-17

  XML Entity Expansion (XEE) in Django

  Fixed in: 1.3.6, 1.4.4

• GHSA-x64m-686f-fmm32022-05-17

  XML External Entity (XXE) in Django

  Fixed in: 1.3.6, 1.4.4

• GHSA-vjjp-9r83-22rc2022-05-17

  Django Directory Traversal via ssi template tag

  Fixed in: 1.4.7, 1.5.3

• GHSA-4c42-4rxm-x6qf2022-05-17

  Django Denial of Service Vulnerability in the authentication framework

  Fixed in: 1.4.8, 1.5.4

• GHSA-46x4-9jmv-jc8p2022-05-17

  Django Access Restrictions Bypass

  Fixed in: 1.9.2

• GHSA-6565-fg86-6jcx2022-05-17

  Django Cross-site Scripting Vulnerability

  Fixed in: 1.7.6, 1.8b2

• GHSA-6wgp-fwfm-mxp32022-05-17

  Django allows user sessions hijacking via an empty string in the session key

  Fixed in: 1.8.2

• GHSA-6wcr-wcqm-3mfh2022-05-17

  Django settings leak in date template filter

  Fixed in: 1.7.11, 1.8.7, 1.9rc2, 316bc3fc9437c5960c24baceb93c73f1939711e4

• GHSA-7qfw-j7hp-v45g2022-05-17

  Django WSGI Header Spoofing Vulnerability

  Fixed in: 1.4.18, 1.6.10, 1.7.3

• GHSA-6g95-x6cj-mg4v2022-05-17

  Django database denial-of-service with ModelMultipleChoiceField

  Fixed in: 1.6.10, 1.7.3, 1.4.18

• GHSA-jhjg-w2cp-5j442022-05-17

  Django DoS in django.views.static.serve

  Fixed in: 1.4.18, 1.6.10, 1.7.3

• GHSA-gv98-g628-m9x52022-05-17

  Django Cross-site Scripting Vulnerability

  Fixed in: 1.4.18, 1.6.10, 1.7.3

• GHSA-x38m-486c-2wr92022-05-17

  Denial-of-service possibility in logout() view by filling session store

  Fixed in: 1.7.10, 1.4.22

• GHSA-89hj-xfx5-7q662022-05-17

  Django Reuses Cached CSRF Token

  Fixed in: 1.4.11, 1.5.6, 1.6.3

• GHSA-rvq6-mrpv-m6rm2022-05-17

  Code Injection in Django

  Fixed in: 1.4.11, 1.5.6, 1.6.3

• GHSA-wqjj-hx84-v4492022-05-17

  Django Vulnerable to MySQL Injection

  Fixed in: 1.4.11, 1.5.6, 1.6.3

• GHSA-q7q2-qf2q-rw3w2022-05-17

  Django Vulnerable to Cache Poisoning

  Fixed in: 1.4.13, 1.5.8, 1.6.5, 1.7b4

• GHSA-4894-5vqc-6r2r2022-05-17

  Django cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget

  Fixed in: 1.5.2, 90363e388c61874add3f3557ee654a996ec75d78, cbe6d5568f4f5053ed7228ca3c3d0cce77cf9560

• GHSA-fp6p-5xvw-m74f2022-05-17

  Django User Enumeration Vulnerability

  Fixed in: 1.8.10, 1.9.3, 67b46ba7016da2d259c1ecc7d666d11f5e1cfaab

• GHSA-pw27-w7w4-9qc72022-05-17

  Django XSS Vulnerability

  Fixed in: 1.8.10, 1.9.3, c5544d289233f501917e25970c03ed444abbd4f0

• GHSA-cqf7-ff9h-79672022-05-17

  Django ReDoS in validators.URLValidator

  Fixed in: 1.8.3

• GHSA-q5qw-4364-5hhm2022-05-17

  Django Vulnerable to HTTP Response Splitting Attack

  Fixed in: 1.4.21, 1.7.9, 1.8.3

• GHSA-pgxh-wfw4-jx2v2022-05-17

  Django denial of service via empty session record creation

  Fixed in: 1.8.4, 1.7.10, 1.4.22

• GHSA-3f2c-jm6v-cr352022-05-17

  Django DNS Rebinding Vulnerability

  Fixed in: 1.8.16, 1.9.11, 1.10.3

• GHSA-mv8g-fhh6-62672022-05-17

  Django user with hardcoded password created when running tests on Oracle

  Fixed in: 1.10.3, 1.9.11, 1.8.16

• GHSA-9cwg-mhxf-hh592022-05-17

  Django cross-site scripting (XSS) vulnerability via is_safe_url function

  Fixed in: 1.4.6, 1.5.2, ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a, ae3535169af804352517b7fea94a42a1c9c4b762, 1a274ccd6bc1afbdac80344c9b6e5810c1162b5f

• GHSA-crhm-qpjc-cm642022-05-14

  Django CSRF Protection Bypass

  Fixed in: 1.8.15, 1.9.10

• GHSA-rm2j-x595-q9cj2022-05-14

  Django Vulnerable to Cache Poisoning

  Fixed in: 1.2.7, 1.3.1

• GHSA-wxg3-mfph-qg9w2022-05-14

  Django Might Allow CSRF Requests via URL Verification

  Fixed in: 1.2.7, 1.3.1

• GHSA-c8c8-9472-w52h2022-05-14

  Django Cross-site scripting Vulnerability

  Fixed in: 1.8.14, 1.9.8, 1.10rc1, d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158, f68e5a99164867ab0e071a936470958ed867479d

• GHSA-vq3h-3q7v-9prw2022-05-14

  Django Allows Open Redirects

  Fixed in: 1.4.13, 1.5.8, 1.6.5, 1.7b4

• GHSA-625g-gx8c-xcmg2022-05-14

  Django Middleware Enables Session Hijacking

  Fixed in: 1.4.14, 1.5.9, 1.6.6, 1.7c3

• GHSA-f7cm-ccfp-3q4r2022-05-14

  Django Incorrectly Validates URLs

  Fixed in: 1.4.14, 1.5.9, 1.6.6

• GHSA-rw75-m7gp-92m32022-05-14

  Django data leakage via querystring manipulation in admin

  Fixed in: 1.4.14, 1.5.9, 1.6.6, 1.7c3, 2b31342cdf14fc20e07c43d258f1e7334ad664a6

• GHSA-j3j3-jrfh-cm2w2022-05-14

  Django Denial-of-service possibility with strip_tags

  Fixed in: 1.6.11, 1.7.7, 1.8c1

• GHSA-7fq8-4pv5-5w5c2022-05-14

  Django cross-site scripting (XSS) attack via user-supplied redirect URLs

  Fixed in: 1.4.20, 1.6.11, 1.7.7, 1.8c1

• GHSA-296w-6qhq-gf922022-05-14

  Django denial of service via file upload naming

  Fixed in: 1.4.14, 1.5.9, 1.6.6

• GHSA-r7w6-p47g-vj532022-05-05

  Django Data leakage via admin history log

  Fixed in: 1.3.6, 1.4.4

• GHSA-g8xg-jgj6-49r32022-05-05

  Django is vulnerable to Denial of Service attack in formset

  Fixed in: 1.3.6, 1.4.4

• GHSA-p6m5-h7pp-v2x52022-05-02

  Django Regex Algorithmic Complexity Causes Denial of Service

  Fixed in: 1.0.4, 1.1.1

• GHSA-9xg7-gg9m-rmq92022-05-02

  Django Admin Media Handler Vulnerable to Directory Traversal

  Fixed in: 0.96.4, 1.0.3, 1.1

• GHSA-r5cj-wv24-92p52022-05-02

  Django cross-site request forgery (CSRF) vulnerability

  Fixed in: 0.91.3, 0.95.4, 0.96.3, 1.1

• GHSA-54qj-48vx-cr9f2022-05-01

  Django Cross-site scripting (XSS) vulnerability

  Fixed in: 0.91.2, 0.95.3, 0.96.2, 1.1

• GHSA-9v8h-57gv-qch62022-05-01

  Django vulnerable to Denial of Service via i18n middleware component

  Fixed in: 0.96.1, 0.95.2, 0.91.1, 1.1

• GHSA-mwv2-398h-v4892022-05-01

  Django Improper Access Control

  Fixed in: 1.0

• GHSA-qc99-g3wm-hgxr2022-05-01

  Django Arbitrary Code Execution

  Fixed in: 1.0

• GHSA-2gwj-7jmv-h26r2022-04-13

  SQL Injection in Django

  Fixed in: 2.2.28, 3.2.13, 4.0.4

• GHSA-w24h-v9qh-8gxj2022-04-13

  SQL Injection in Django

  Fixed in: 2.2.28, 3.2.13, 4.0.4

• GHSA-95rw-fx8r-36v62022-02-04

  Cross-site Scripting in Django

  Fixed in: 2.2.27, 3.2.12, 4.0.2

• GHSA-6cw3-g6wv-c2xv2022-02-04

  Infinite Loop in Django

  Fixed in: 2.2.27, 3.2.12, 4.0.2

• GHSA-8c5j-9r9f-c6w82022-01-12

  Information disclosure in Django

  Fixed in: 2.2.26, 3.2.11, 4.0.1

• GHSA-jrh2-hc4r-7jwx2022-01-12

  Directory-traversal in Django

  Fixed in: 2.2.26, 3.2.11, 4.0.1

• GHSA-53qw-q765-4fww2022-01-12

  Denial-of-service in Django

  Fixed in: 2.2.26, 3.2.11, 4.0.1

• GHSA-v6rh-hp5x-86rv2021-12-09

  Potential bypass of an upstream access control based on URL paths in Django

  Fixed in: 2.2.25, 3.1.14, 3.2.10

• GHSA-xpfp-f569-q3p22021-09-22

  SQL Injection in Django

  Fixed in: 3.2.5, 3.1.13

• GHSA-p99v-5w3c-jqq92021-06-10

  Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks

  Fixed in: 2.2.24, 3.1.12, 3.2.4

• GHSA-68w8-qjq3-2gfm2021-06-10

  Path Traversal in Django

  Fixed in: 2.2.24, 3.1.12, 3.2.4

• GHSA-qm57-vhq3-3fwf2021-06-09

  Header injection possible in Django

  Fixed in: 2.2.22, 3.1.10, 3.2.2

• GHSA-rxjp-mfm9-w4wr2021-06-04

  Path Traversal in Django

  Fixed in: 2.2.21, 3.1.9, 3.2.1

• GHSA-xgxc-v2qg-chmh2021-04-08

  Directory Traversal in Django

  Fixed in: 2.2.20, 3.0.14, 3.1.8

• GHSA-m6gj-h9gm-gw442021-03-18

  Django Incorrect Default Permissions

  Fixed in: 2.2.16, 3.0.10, 3.1.1

• GHSA-fr28-569j-53c42021-03-18

  Django Incorrect Default Permissions

  Fixed in: 2.2.16, 3.0.10, 3.1.1

• GHSA-fvgf-6h6h-33222021-03-18

  Django Directory Traversal via archive.extract

  Fixed in: 2.2.18, 3.1.6, 3.0.12

• GHSA-2m34-jcjv-45xf2020-06-05

  XSS in Django

  Fixed in: 2.2.13, 3.0.7

• GHSA-wpjr-j57x-wxfw2020-06-05

  Data leakage via cache key collision in Django

  Fixed in: 2.2.13, 3.0.7

• GHSA-3gh2-xw74-jmcw2020-06-05

  SQL injection in Django

  Fixed in: 1.11.29, 2.2.11, 3.0.4

• GHSA-hmr4-m2h5-33qx2020-02-11

  SQL injection in Django

  Fixed in: 1.11.28, 2.2.10, 3.0.3, eb31d845323618d688ad429479c6dda973056136

• GHSA-vfq6-hq5r-27r62020-01-16

  Django Potential account hijack via password reset form

  Fixed in: 1.11.27, 2.2.9, 3.0.1

• GHSA-hvmf-r92r-27hr2019-12-04

  Django allows unintended model editing

  Fixed in: 2.1.15, 2.2.8

• GHSA-6r97-cj55-9hrq2019-08-16

  SQL Injection in Django

  Fixed in: 1.11.23, 2.1.11, 2.2.4

• GHSA-h5jv-4p7w-64jg2019-08-06

  Django Denial-of-service in strip_tags()

  Fixed in: 1.11.23, 2.1.11, 2.2.4

• GHSA-v9qg-3j8p-r63v2019-08-06

  Uncontrolled Recursion in Django

  Fixed in: 1.11.23, 2.1.11, 2.2.4

• GHSA-c4qh-4vgv-qc6g2019-08-06

  Django Denial-of-service in django.utils.text.Truncator

  Fixed in: 1.11.23, 2.1.11, 2.2.4

• GHSA-h582-2pch-3xv32019-07-05

  Django Denial-of-service by filling session store

  Fixed in: 1.4.21, 1.7.9, 1.8.3

• GHSA-6c7v-2f49-8h262019-07-03

  Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS

  Fixed in: 2.1.10, 2.2.3, 1.11.22

• GHSA-7rp2-fm2h-wchj2019-06-10

  Django Cross-site Scripting in AdminURLFieldWidget

  Fixed in: 1.11.21, 2.1.9, 2.2.2

• GHSA-6c3j-c64m-qhgq2019-04-26

  XSS in jQuery as used in Drupal, Backdrop CMS, and other products

  Fixed in: 3.4.0, 4.3.4, 2.1.9, 2.2.2, 1.19.0

• GHSA-wh4h-v3f2-r2pp2019-02-12

  Uncontrolled Memory Consumption in Django

  Fixed in: 1.11.19, 2.0.11, 2.1.6, 2.0.12, 2.1.7

• GHSA-337x-4q8g-prc52019-01-14

  Improper Input Validation in Django

  Fixed in: 1.11.18, 2.0.10, 2.1.5

• GHSA-9r8w-6x8c-6jr92019-01-04

  Django vulnerable to XSS on 500 pages

  Fixed in: 1.10.8, 1.11.5

• GHSA-37hp-765x-j95x2019-01-04

  Django open redirect and possible XSS attack via user-supplied numeric redirect URLs

  Fixed in: 1.10.7, 1.9.13, 1.8.18

• GHSA-h4hv-m4h4-mhwg2019-01-04

  Django open redirect

  Fixed in: 1.10.7, 1.9.13, 1.8.18

• GHSA-r28v-mw67-m5p92019-01-04

  Django denial-of-service possibility in urlize and urlizetrunc template filters

  Fixed in: 2.0.3, 1.11.11, 1.8.19

• GHSA-2f9x-5v75-3qv42019-01-04

  Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters

  Fixed in: 2.0.3, 1.11.11, 1.8.19

• GHSA-5hg3-6c2f-f3wr2018-10-04

  Django open redirect

  Fixed in: 2.0.8, 1.11.15

• GHSA-rf4j-j272-fj862018-10-03

  Django vulnerable to information leakage in AuthenticationForm

  Fixed in: 2.0.2, 1.11.10

• GHSA-6mx3-3vqg-hpp22018-10-03

  Django allows unprivileged users to read the password hashes of arbitrary accounts

  Fixed in: 2.1.2

• GHSA-8m3r-rv5g-fcpq2018-07-23

  Cross-site scripting in django

  Fixed in: 1.1.4, 1.2.5

• GHSA-fxpg-gg9g-76gj2018-07-23

  Cross-site scripting in django

  Fixed in: 1.2.2

• GHSA-x88j-93vc-wpmp2018-07-23

  Session manipulation in Django

  Fixed in: 1.2.7, 1.3.1

• GHSA-7g9h-c88w-r7h22018-07-23

  Directory traversal in Django

  Fixed in: 1.1.4, 1.2.5

• GHSA-7wph-fc4w-wqp22018-07-23

  Improper date handling in Django

  Fixed in: 1.1.3, 1.2.4

• GHSA-fwr5-q9rx-294f2018-07-23

  Improper query string handling in Django

  Fixed in: 1.1.3, 1.2.4

• GHSA-3jqw-crqj-w8qw2018-07-23

  Denial of service in django

  Fixed in: 1.2.7, 1.3.1

• GHSA-h95j-h2rv-qrg42018-07-23

  Django Cross-Site Request Forgery vulnerability

  Fixed in: 1.2.7, 1.3.1

• GHSA-5j2h-h5hg-3wf82018-07-23

  Cross-site request forgery in Django

  Fixed in: 1.1.4, 1.2.5