"CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods django.utils.text.Truncator.chars() and Truncator.words() methods (with html=True) and truncatechars_html and truncatewords_html template filters were subject to a potential denial-of-service attack via certain inputs with a large number of unmatched HTML end tags, which could cause quadratic time complexity during HTML parsing. Thanks to Seokchan Yoon for the report. This issue has severity "moderate" according to the Django security policy."
"We encourage all users of Django to upgrade as soon as possible. CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS Raster lookups on GIS fields (only implemented on PostGIS) were subject to SQL injection if untrusted data was used as a band index. As a reminder, all untrusted user input should be validated before use. Thanks to Tarek Nakkouch for the report. This issue has severity "high" according to the Django security policy."
Releases 6.0.2, 5.2.11, and 4.2.28 fix multiple security vulnerabilities and should be applied promptly. CVE-2025-13473 allowed username enumeration via a timing difference in mod_wsgi authentication through django.contrib.auth.handlers.modwsgi.check_password(), rated low. CVE-2026-1207 allowed SQL injection in PostGIS raster lookups when untrusted data was used as a band index, rated high; untrusted input must be validated. CVE-2026-1285 caused a potential denial-of-service in Truncator HTML methods and related template filters due to many unmatched end tags, rated moderate. CVE-2026-1287 allowed SQL injection in column aliases via control characters in FilteredRelation. Users should upgrade as soon as possible.
Read at Django Project
Unable to calculate read time
Collection
[
|
...
]