Django 5.2.17

Direct Vulnerabilities

Known vulnerabilities in the Django package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Memory Allocation with Excessive Size Value Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to the `get_supported_language_variant()` function in `django/utils/translation/trans_real.py`. An attacker can exhaust process memory by sending many distinct, very long language codes that are cached as `lru_cache` keys before the length check is applied. This can grow the in-memory cache with attacker-controlled values and degrade or crash a Django process handling requests that supply language codes. How to fix Memory Allocation with Excessive Size Value? Upgrade `Django` to version 5.2.18, 6.0.9, 6.1.2 or higher.	[,5.2.18)[6.0a1,6.0.9)[6.1a1,6.1.2)
M Server-side Request Forgery (SSRF) Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the spatial lookup handling in `django/contrib/gis/db/models/fields.py` and `django/contrib/gis/gdal/raster/source.py`. An attacker can cause the Django process to make network requests by supplying attacker-controlled `bytes` to a raster lookup that is processed as a GDAL raster input. The vulnerable code accepts `bytes` in lookup contexts without requiring explicit `GDALRaster` wrapping, and GDAL can interpret that data as a VRT document referencing external raster sources. This lets an attacker trigger outbound file or network access while the lookup is being prepared, exposing the application to unintended requests made as the Django process user. How to fix Server-side Request Forgery (SSRF)? Upgrade `Django` to version 5.2.18, 6.0.9, 6.1.2 or higher.	[,5.2.18)[6.0a1,6.0.9)[6.1a1,6.1.2)
M Authorization Bypass Through User-Controlled Key Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through forged model formset submissions. An attacker can delete objects outside the formset’s limiting queryset by submitting POST data that supplies an editable primary key for a newly constructed instance and marks it for deletion. This lets an authenticated user with permission to submit the formset remove rows they are not authorized to target, while models with the default `AutoField` primary key are not affected. How to fix Authorization Bypass Through User-Controlled Key? Upgrade `Django` to version 5.2.18, 6.0.9, 6.1.2 or higher.	[,5.2.18)[6.0a1,6.0.9)[6.1a1,6.1.2)
M Inefficient Algorithmic Complexity Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity due to quadratic-time parsing in `django.utils.http.parse_header_parameters()` within `django/utils/http.py`. An attacker can exhaust CPU by sending an unauthenticated request with an `Accept` or `Content-Type` header containing many separators inside a quoted parameter. This slows or stalls request processing in code paths such as `HttpRequest.accepts()`, degrading service for other users and making the application unresponsive under repeated malicious requests. How to fix Inefficient Algorithmic Complexity? Upgrade `Django` to version 5.2.18, 6.0.9, 6.1.2 or higher.	[,5.2.18)[6.0a1,6.0.9)[6.1a1,6.1.2)

Vulnerability

Vulnerable Version

Memory Allocation with Excessive Size Value

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to the get_supported_language_variant() function in django/utils/translation/trans_real.py. An attacker can exhaust process memory by sending many distinct, very long language codes that are cached as lru_cache keys before the length check is applied. This can grow the in-memory cache with attacker-controlled values and degrade or crash a Django process handling requests that supply language codes.

How to fix Memory Allocation with Excessive Size Value?

Upgrade Django to version 5.2.18, 6.0.9, 6.1.2 or higher.

[,5.2.18)[6.0a1,6.0.9)[6.1a1,6.1.2)

Server-side Request Forgery (SSRF)

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the spatial lookup handling in django/contrib/gis/db/models/fields.py and django/contrib/gis/gdal/raster/source.py. An attacker can cause the Django process to make network requests by supplying attacker-controlled bytes to a raster lookup that is processed as a GDAL raster input. The vulnerable code accepts bytes in lookup contexts without requiring explicit GDALRaster wrapping, and GDAL can interpret that data as a VRT document referencing external raster sources. This lets an attacker trigger outbound file or network access while the lookup is being prepared, exposing the application to unintended requests made as the Django process user.

How to fix Server-side Request Forgery (SSRF)?

Upgrade Django to version 5.2.18, 6.0.9, 6.1.2 or higher.

[,5.2.18)[6.0a1,6.0.9)[6.1a1,6.1.2)

Authorization Bypass Through User-Controlled Key

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through forged model formset submissions. An attacker can delete objects outside the formset’s limiting queryset by submitting POST data that supplies an editable primary key for a newly constructed instance and marks it for deletion. This lets an authenticated user with permission to submit the formset remove rows they are not authorized to target, while models with the default AutoField primary key are not affected.

How to fix Authorization Bypass Through User-Controlled Key?

Upgrade Django to version 5.2.18, 6.0.9, 6.1.2 or higher.

[,5.2.18)[6.0a1,6.0.9)[6.1a1,6.1.2)

Inefficient Algorithmic Complexity

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity due to quadratic-time parsing in django.utils.http.parse_header_parameters() within django/utils/http.py. An attacker can exhaust CPU by sending an unauthenticated request with an Accept or Content-Type header containing many separators inside a quoted parameter. This slows or stalls request processing in code paths such as HttpRequest.accepts(), degrading service for other users and making the application unresponsive under repeated malicious requests.

How to fix Inefficient Algorithmic Complexity?

Upgrade Django to version 5.2.18, 6.0.9, 6.1.2 or higher.

[,5.2.18)[6.0a1,6.0.9)[6.1a1,6.1.2)

Django@5.2.17

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically