Django’s development team is strongly committed to responsible reporting and disclosure of security-related issues, as outlined in Django’s security policies.
As part of that commitment, we maintain the following historical list of issues which have been fixed and disclosed. For each issue, the list below includes the date, a brief description, the CVE identifier if applicable, a list of affected versions, a link to the full disclosure and links to the appropriate patch(es).
Issues under Django’s security process¶All security issues have been handled under versions of Django’s security process. These are listed below.
June 4, 2025 - CVE 2025-48432¶Potential log injection via unescaped request path. Full description
There was an additional hardening with new patch releases published on June 10, 2025. Full description
May 7, 2025 - CVE 2025-32873¶Denial-of-service possibility in strip_tags(). Full description
Potential denial-of-service vulnerability in LoginView, LogoutView, and set_language() on Windows. Full description
Potential denial-of-service in django.utils.text.wrap(). Full description
Potential denial-of-service vulnerability in IPv6 validation. Full description
December 4, 2024 - CVE 2024-53907¶Potential denial-of-service in django.utils.html.strip_tags(). Full description
Potential SQL injection in HasKey(lhs, rhs) on Oracle. Full description
Potential user email enumeration via response status on password reset. Full description
September 3, 2024 - CVE 2024-45230¶Potential denial-of-service vulnerability in django.utils.html.urlize(). Full description
Potential SQL injection in QuerySet.values() and values_list(). Full description
Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget. Full description
Potential denial-of-service vulnerability in django.utils.html.urlize(). Full description
Potential memory exhaustion in django.utils.numberformat.floatformat(). Full description
Potential denial-of-service in django.utils.translation.get_supported_language_variant(). Full description
Potential directory-traversal in django.core.files.storage.Storage.save(). Full description
Username enumeration through timing difference for users with unusable passwords. Full description
July 9, 2024 - CVE 2024-38875¶Potential denial-of-service in django.utils.html.urlize(). Full description
Potential regular expression denial-of-service in django.utils.text.Truncator.words(). Full description
Potential denial-of-service in intcomma template filter. Full description
Potential denial of service vulnerability in UsernameField on Windows. Full description
Denial-of-service possibility in django.utils.text.Truncator. Full description
Potential denial of service vulnerability in django.utils.encoding.uri_to_iri(). Full description
Potential regular expression denial of service vulnerability in EmailValidator/URLValidator. Full description
Potential bypass of validation when uploading multiple files using one form field. Full description
February 14, 2023 - CVE 2023-24580¶Potential denial-of-service vulnerability in file uploads. Full description
February 1, 2023 - CVE 2023-23969¶Potential denial-of-service via Accept-Language headers. Full description
Potential denial-of-service vulnerability in internationalized URLs. Full description
August 3, 2022 - CVE 2022-36359¶Potential reflected file download vulnerability in FileResponse. Full description
July 4, 2022 - CVE 2022-34265¶Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments. Full description
Potential SQL injection in QuerySet.annotate(), aggregate(), and extra(). Full description
Potential SQL injection via QuerySet.explain(**options) on PostgreSQL. Full description
Possible XSS via {% debug %} template tag. Full description
Denial-of-service possibility in file uploads. Full description
Versions affected¶ January 4, 2022 - CVE 2021-45452¶Potential directory-traversal via Storage.save(). Full description
Potential information disclosure in dictsort template filter. Full description
Denial-of-service possibility in UserAttributeSimilarityValidator. Full description
Potential bypass of an upstream access control based on URL paths. Full description
Versions affected¶ July 1, 2021 - CVE 2021-35042¶Potential SQL injection via unsanitized QuerySet.order_by() input. Full description
Potential directory traversal via admindocs. Full description
Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses. Full description
Versions affected¶ May 6, 2021 - CVE 2021-32052¶Header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+. Full description
Potential directory-traversal via uploaded files. Full description
Versions affected¶ April 6, 2021 - CVE 2021-28658¶Potential directory-traversal via uploaded files. Full description
Versions affected¶ February 19, 2021 - CVE 2021-23336¶Web cache poisoning via django.utils.http.limited_parse_qsl(). Full description
Potential directory-traversal via archive.extract(). Full description
Permission escalation in intermediate-level directories of the file system cache on Python 3.7+. Full description
Versions affected¶ September 1, 2020 - CVE 2020-24583¶Incorrect permissions on intermediate-level directories on Python 3.7+. Full description
Versions affected¶ June 3, 2020 - CVE 2020-13596¶Possible XSS via admin ForeignKeyRawIdWidget. Full description
Potential data leakage via malformed memcached keys. Full description
Versions affected¶ March 4, 2020 - CVE 2020-9402¶Potential SQL injection via tolerance parameter in GIS functions and aggregates on Oracle. Full description
Potential SQL injection via StringAgg(delimiter). Full description
Potential account hijack via password reset form. Full description
Versions affected¶ December 2, 2019 - CVE 2019-19118¶Privilege escalation in the Django admin. Full description
Versions affected¶ August 1, 2019 - CVE 2019-14235¶Potential memory exhaustion in django.utils.encoding.uri_to_iri(). Full description
SQL injection possibility in key and index lookups for JSONField/HStoreField. Full description
Denial-of-service possibility in strip_tags(). Full description
Denial-of-service possibility in django.utils.text.Truncator. Full description
Incorrect HTTP detection with reverse-proxy connecting via HTTPS. Full description
Versions affected¶ June 3, 2019 - CVE 2019-12308¶XSS via “Current URL” link generated by AdminURLFieldWidget. Full description
Prototype pollution in bundled jQuery. Full description
Versions affected¶ February 11, 2019 - CVE 2019-6975¶Memory exhaustion in django.utils.numberformat.format(). Full description
Django 2.1 (patch)
Django 2.0 (patch and correction)
Django 1.11 (patch)
Content spoofing possibility in the default 404 page. Full description
Versions affected¶ October 1, 2018 - CVE 2018-16984¶Password hash disclosure to “view only” admin users. Full description
Versions affected¶Django 2.1 (patch)
Open redirect possibility in CommonMiddleware. Full description
Denial-of-service possibility in truncatechars_html and truncatewords_html template filters. Full description
Denial-of-service possibility in urlize and urlizetrunc template filters. Full description
Information leakage in AuthenticationForm. Full description
Possible XSS in traceback section of technical 500 debug page. Full description
Versions affected¶ April 4, 2017 - CVE 2017-7234¶Open redirect vulnerability in django.views.static.serve(). Full description
Open redirect and possible XSS attack via user-supplied numeric redirect URLs. Full description
Versions affected¶ November 1, 2016 - CVE 2016-9014¶DNS rebinding vulnerability when DEBUG=True. Full description
User with hardcoded password created when running tests on Oracle. Full description
Versions affected¶ September 26, 2016 - CVE 2016-7401¶CSRF protection bypass on a site with Google Analytics. Full description
Versions affected¶ July 18, 2016 - CVE 2016-6186¶XSS in admin’s add/change related popup. Full description
Versions affected¶ March 1, 2016 - CVE 2016-2513¶User enumeration through timing difference on password hasher work factor upgrade. Full description
Versions affected¶ March 1, 2016 - CVE 2016-2512¶Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth. Full description
Versions affected¶ February 1, 2016 - CVE 2016-2048¶User with “change” but not “add” permission can create objects for ModelAdmin’s with save_as=True. Full description
Django 1.9 (patch)
Settings leak possibility in date template filter. Full description
Denial-of-service possibility in logout() view by filling session store. Full description
Denial-of-service possibility in URL validation. Full description
Versions affected¶Django 1.8 (patch)
Header injection possibility since validators accept newlines in input. Full description
Versions affected¶ July 8, 2015 - CVE 2015-5143¶Denial-of-service possibility by filling session store. Full description
Versions affected¶ May 20, 2015 - CVE 2015-3982¶Fixed session flushing in the cached_db backend. Full description
Versions affected¶Django 1.8 (patch)
Mitigated possible XSS attack via user-supplied redirect URLs. Full description
Versions affected¶ March 18, 2015 - CVE 2015-2316¶Denial-of-service possibility with strip_tags(). Full description
XSS attack via properties in ModelAdmin.readonly_fields. Full description
Database denial-of-service with ModelMultipleChoiceField. Full description
Denial-of-service attack against django.views.static.serve(). Full description
Mitigated possible XSS attack via user-supplied redirect URLs. Full description
Versions affected¶ January 13, 2015 - CVE 2015-0219¶WSGI header spoofing via underscore/dash conflation. Full description
Versions affected¶ August 20, 2014 - CVE 2014-0483¶Data leakage via querystring manipulation in admin. Full description
Versions affected¶ August 20, 2014 - CVE 2014-0482¶RemoteUserMiddleware session hijacking. Full description
File upload denial of service. Full description
Versions affected¶ August 20, 2014 - CVE 2014-0480¶reverse() can generate URLs pointing to other hosts. Full description
Malformed URLs from user input incorrectly validated. Full description
Versions affected¶ May 18, 2014 - CVE 2014-1418¶Caches may be allowed to store and serve private data. Full description
Versions affected¶ April 21, 2014 - CVE 2014-0474¶MySQL typecasting causes unexpected query results. Full description
Versions affected¶ April 21, 2014 - CVE 2014-0473¶Caching of anonymous pages could reveal CSRF token. Full description
Versions affected¶ April 21, 2014 - CVE 2014-0472¶Unexpected code execution using reverse(). Full description
Denial-of-service via large passwords. Full description
Versions affected¶Django 1.4 (patch and Python compatibility fix)
Django 1.5 (patch)
Directory-traversal via ssi template tag. Full description
Possible XSS via unvalidated URL redirect schemes. Full description
Versions affected¶ August 13, 2013 - CVE 2013-4249¶XSS via admin trusting URLField values. Full description
Django 1.5 (patch)
Denial-of-service via formset max_num bypass. Full description
Information leakage via admin history log. Full description
Versions affected¶ February 19, 2013 - CVE 2013-1664 / CVE 2013-1665¶Entity-based attacks against Python XML libraries. Full description
Versions affected¶ February 19, 2013 - No CVE¶Additional hardening of Host header handling. Full description
Additional hardening of redirect validation. Full description
Versions affected¶ December 10, 2012 - No CVE 1¶Additional hardening of Host header handling. Full description
Host header poisoning. Full description
Denial-of-service via large image files. Full description
Versions affected¶ July 30, 2012 - CVE 2012-3443¶Denial-of-service via compressed image files. Full description
Versions affected¶ July 30, 2012 - CVE 2012-3442¶XSS via failure to validate redirect scheme. Full description
Versions affected¶ September 9, 2011 - CVE 2011-4140¶Potential CSRF via Host header. Full description
This notification was an advisory only, so no patches were issued.
Django 1.2
Django 1.3
Host header cache poisoning. Full description
Information leakage/arbitrary request issuance via URLField.verify_exists. Full description
Denial-of-service via URLField.verify_exists. Full description
Session manipulation when using memory-cache-backed session. Full description
Versions affected¶ February 8, 2011 - CVE 2011-0698¶Directory-traversal on Windows via incorrect path-separator handling. Full description
Versions affected¶ February 8, 2011 - CVE 2011-0697¶XSS via unsanitized names of uploaded files. Full description
Versions affected¶ February 8, 2011 - CVE 2011-0696¶CSRF via forged HTTP headers. Full description
Versions affected¶ December 22, 2010 - CVE 2010-4535¶Denial-of-service in password-reset mechanism. Full description
Versions affected¶ December 22, 2010 - CVE 2010-4534¶Information leakage in administrative interface. Full description
Versions affected¶ September 8, 2010 - CVE 2010-3082¶XSS via trusting unsafe cookie value. Full description
Versions affected¶Django 1.2 (patch)
Denial-of-service via pathological regular expression performance. Full description
Versions affected¶ July 28, 2009 - CVE 2009-2659¶Directory-traversal in development server media handler. Full description
Versions affected¶ September 2, 2008 - CVE 2008-3909¶CSRF via preservation of POST data during admin login. Full description
Versions affected¶ May 14, 2008 - CVE 2008-2302¶XSS via admin login redirect. Full description
Versions affected¶ October 26, 2007 - CVE 2007-5712¶Denial-of-service via arbitrarily-large Accept-Language header. Full description
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4