ELA-1808-1 python-django security update

multiple vulnerabilities

2026-08-12

Two issues were discovered in Django, the Python-based web development framework:

CVE-2026-15337: Avoid a potential denial-of-service vulnerability in the check_for_language() method in the django.utils.translation module. This method was subject to a potential denial-of-service (DoS) attack when checking many distinct, very long language codes. To mitigate this vulnerability, language codes longer than 500 characters are now rejected before the cached lookup.
CVE-2026-15920: Prevent a potential cross-site scripting (XSS) attack via bogus URLField values in the Django admin. The admin renders URLField values as clickable links on ‘changelist’ views and read-only fields. This link was hitherto generated without validating the value as a safe URL, so a stored value using a potentially dangerous scheme was rendered as a link. URLField values shown via display_for_field are now validated using the URLValidator class before a link is rendered and displayed as plain text if validation fails.

For Debian 10 buster, these problems have been fixed in version 1:1.11.29-1+deb10u20.

For Debian 9 stretch, these problems have been fixed in version 1:1.10.7-2+deb9u31.

We recommend that you upgrade your python-django packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.