... nd also contains an opt-in feature to enhance the security of django.contrib.sessions . Directory traversal vulnerability in ssi template tag ¶ In previous versions of Django it was possible to bypass the ALLOWED_INCLUDE_ROOTS setting used for ... thor to put the ssi file in a user-controlled variable, but it's possible in principle. Mitigating a remote-code execution vulnerability in django.contrib.sessions ¶ django.contrib.sessions currently uses pickle to serialize session data before storing it in ... backend. If you're using the signed cookie session backend and SECRET_KEY is known by an attacker (there isn't an inherent vulnerability in Django that would cause it to leak), the attacker could insert a string into their session which, when unpickled, execu ... ... nd also contains an opt-in feature to enhance the security of django.contrib.sessions . Directory traversal vulnerability in ssi template tag ¶ In previous versions of Django it was possible to bypass the ALLOWED_INCLUDE_ROOTS setting used for ... thor to put the ssi file in a user-controlled variable, but it's possible in principle. Mitigating a remote-code execution vulnerability in django.contrib.sessions ¶ django.contrib.sessions currently uses pickle to serialize session data before storing it in ... backend. If you're using the signed cookie session backend and SECRET_KEY is known by an attacker (there isn't an inherent vulnerability in Django that would cause it to leak), the attacker could insert a string into their session which, when unpickled, execu ... ... ttack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker ... to cause a potential denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-linear computation resu ... e use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text.Truncator.chars() and Truncator.words() methods (with html ... ... ttack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker ... to cause a potential denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-linear computation resu ... e use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text.Truncator.chars() and Truncator.words() methods (with html ... ... ttack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker ... to cause a potential denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-linear computation resu ... e use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text.Truncator.chars() and Truncator.words() methods (with html ... ... ttack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker ... to cause a potential denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-linear computation resu ... e use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text.Truncator.chars() and Truncator.words() methods (with html ... ... ons . This issue has severity "high" according to the Django security policy . CVE-2026-15337: Potential denial-of-service vulnerability in check_for_language() ¶ check_for_language() was subject to a potential denial-of-service attack when checking many dist ... cache is configured to store a maximum number of entries, the memory that could be consumed was bounded. To mitigate this vulnerability, language codes longer than 500 characters are now rejected before the cached lookup. This issue has severity "low" accord ... ing to the Django security policy . CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections ¶ GEOSGeometry was subject to a potential denial-of-service attack when provided deeply ne ... ... ttack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker ... to cause a potential denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-linear computation resu ... e use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text.Truncator.chars() and Truncator.words() methods (with html ... ... ttack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker ... to cause a potential denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-linear computation resu ... e use. This issue has severity "high" according to the Django security policy . CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods ¶ django.utils.text.Truncator.chars() and Truncator.words() methods (with html ... ... cient security mitigation in 5.2.17. It also fixes one data loss issue in 4.0. CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant() ¶ get_supported_language_variant() was subject to a potential denial-of-service attack ... ys in an in-memory cache before their length was limited, potentially consuming excessive process memory. To mitigate this vulnerability, language codes longer than 500 characters are now rejected or truncated before the cached lookup. This issue has severity ... "low" according to the Django security policy . CVE-2026-84429: Potential denial-of-service vulnerability in HTTP header parsing ¶ django.utils.http.parse_header_parameters() was subject to a potential denial-of-service attack d ... 2026年10月08日