| Package | python-django |
|---|---|
| Version | 1:1.10.7-2+deb9u33 (stretch), 1:1.11.29-1+deb10u22 (buster), 2:2.2.28-1~deb11u15 (bullseye) |
| Related CVEs | CVE-2026-77050 CVE-2026-87975 |
Two vulnerabilities were discovered in Django, the popular Python web-development framework:
-
CVE-2026-77050: Potential denial-of-service vulnerability inget_supported_language_variant. This method was subject to a potential denial-of-service attack when processing many distinct and very long language codes. Language codes were used as keys in an in-memory cache before their length was limited, potentially consuming excessive process memory. To mitigate this vulnerability, language codes longer than 500 characters are now rejected or truncated before the cached lookup. -
CVE-2026-87975: Prevent privilege abuse in model formsets with editable primary keys. Model formsets incorrectly allowed forgedPOSTdata to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model’s primary key could be set through the form, such as with aOneToOneField(or parent link used as the primary key of an inline formset’s model), or a natural or UUID primary key included in the form’s fields. Models using the defaultBigAutoFieldprimary key were not affected.
For Debian 10 buster, these problems have been fixed in version 1:1.11.29-1+deb10u22.
For Debian 11 bullseye, these problems have been fixed in version 2:2.2.28-1~deb11u15.
For Debian 9 stretch, these problems have been fixed in version 1:1.10.7-2+deb9u33.
We recommend that you upgrade your python-django packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.