VulnerableCode Package Details - pkg:deb/debian/python-django@2:2.2.28-1~deb11u2

Vulnerabilities affecting this package (12)

Vulnerability	Summary	Fixed by
VCID-32d1-b8f2-hud5 Aliases: BIT-django-2026-33034 CVE-2026-33034 GHSA-933h-hp56-hf7m PYSEC-2026-49	An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities. 3:4.2.28-0+deb13u2 Affected by 0 other vulnerabilities.
VCID-3ccr-92q5-aqfk Aliases: BIT-django-2026-35192 CVE-2026-35192 GHSA-7h2m-m8vj-598h PYSEC-2026-50	An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities. 3:4.2.28-0+deb13u2 Affected by 0 other vulnerabilities. 3:5.2.14-2 Affected by 0 other vulnerabilities.
VCID-63c7-mkxw-ufav Aliases: BIT-django-2026-33033 CVE-2026-33033 GHSA-5mf9-h53q-7mhq PYSEC-2026-48	An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities. 3:4.2.28-0+deb13u2 Affected by 0 other vulnerabilities.
VCID-92z2-3rbz-77h9 Aliases: BIT-django-2026-5766 CVE-2026-5766 GHSA-w26r-rmm8-9c29 PYSEC-2026-54	An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kyle Agronick for reporting this issue.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities. 3:4.2.28-0+deb13u2 Affected by 0 other vulnerabilities. 3:5.2.14-2 Affected by 0 other vulnerabilities.
VCID-ape9-66ck-nfez Aliases: BIT-django-2024-38875 CVE-2024-38875 GHSA-qg2p-9jwr-mmqf PYSEC-2024-56	An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities.
VCID-cg44-thdw-cygg Aliases: BIT-django-2026-4292 CVE-2026-4292 GHSA-mmwr-2jhp-mc7j PYSEC-2026-53	An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities. 3:4.2.28-0+deb13u2 Affected by 0 other vulnerabilities.
VCID-dac4-fa2z-bkdq Aliases: CVE-2026-25674 GHSA-mjgh-79qc-68w3	Django has a Race Condition vulnerability An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary `umask` change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities. 3:4.2.28-0+deb13u2 Affected by 0 other vulnerabilities.
VCID-g22z-jue5-8udz Aliases: BIT-django-2026-6907 CVE-2026-6907 GHSA-5hrc-gvxj-w55p PYSEC-2026-55	An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities. 3:4.2.28-0+deb13u2 Affected by 0 other vulnerabilities. 3:5.2.14-2 Affected by 0 other vulnerabilities.
VCID-heum-8mwz-sbcw Aliases: BIT-django-2026-4277 CVE-2026-4277 GHSA-pwjp-ccjc-ghwg PYSEC-2026-52	An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities. 3:4.2.28-0+deb13u2 Affected by 0 other vulnerabilities.
VCID-j2uz-w2ur-7ud4 Aliases: BIT-django-2026-3902 CVE-2026-3902 GHSA-mvfq-ggxm-9mc5 PYSEC-2026-51	An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities. 3:4.2.28-0+deb13u2 Affected by 0 other vulnerabilities.
VCID-jt9m-kd3k-uqca Aliases: BIT-django-2024-45230 CVE-2024-45230 GHSA-5hgc-2vfp-mqvc PYSEC-2024-102	An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities.
VCID-q4cv-2m7d-3qd5 Aliases: BIT-django-2024-41990 CVE-2024-41990 GHSA-795c-9xpc-xw6g PYSEC-2024-68	An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.	3:3.2.25-0+deb12u3 Affected by 0 other vulnerabilities.

Next non-vulnerable version	3:3.2.25-0+deb12u3
Latest non-vulnerable version	3:5.2.14-2
Risk

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-05-31T18:58:42.503609+00:00	Debian Importer	Affected by	VCID-jt9m-kd3k-uqca	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T18:58:02.064909+00:00	Debian Importer	Affected by	VCID-63c7-mkxw-ufav	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T18:53:34.395026+00:00	Debian Importer	Affected by	VCID-dac4-fa2z-bkdq	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T18:26:04.665298+00:00	Debian Importer	Affected by	VCID-j2uz-w2ur-7ud4	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T18:14:55.621561+00:00	Debian Importer	Affected by	VCID-3ccr-92q5-aqfk	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T18:05:31.689631+00:00	Debian Importer	Affected by	VCID-heum-8mwz-sbcw	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T18:00:41.691098+00:00	Debian Importer	Affected by	VCID-q4cv-2m7d-3qd5	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T17:58:53.860896+00:00	Debian Importer	Affected by	VCID-32d1-b8f2-hud5	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T17:34:34.505423+00:00	Debian Importer	Affected by	VCID-ape9-66ck-nfez	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T17:17:52.406795+00:00	Debian Importer	Affected by	VCID-cg44-thdw-cygg	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T17:16:06.768681+00:00	Debian Importer	Affected by	VCID-g22z-jue5-8udz	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-05-31T17:11:31.450153+00:00	Debian Importer	Affected by	VCID-92z2-3rbz-77h9	https://security-tracker.debian.org/tracker/data/json	38.6.0