Django Security Releases for 6.0.8 and 5.2.17 Address Multiple Vulnerabilities
Django has released versions 6.0.8 and 5.2.17 to address multiple security vulnerabilities, including server-side file writes, denial-of-service risks, and cross-site scripting. These patches are critical for all users to upgrade to mitigate potential exploits, especially concerning spatial lookups, language code handling, geometry collections, and URL field rendering in the admin interface. The updates impact Django 6.0 and 5.2 branches, with fixes also available for the 6.1 release candidate.
- →Server-side file write and request forgery via spatial lookups
- →Denial-of-service vulnerability in check_for_language()
- →Denial-of-service vulnerability via nested geometry collections
- →Cross-site scripting via URLField values in the admin
- →Security release policy and reporting
Security (4) ›
- Server-side file write and request forgery via spatial lookups
Spatial lookups in Django improperly handled lookup values passed to GDALRaster, potentially allowing server-side file writes, remote code execution, or network requests. This vulnerability was reachable by staff users on models with spatial fields. The fix disallows dicts and invalid GEOSGeometry strings in spatial lookups, marking this as a backward-incompatible change.
- Denial-of-service vulnerability in check_for_language()
A potential denial-of-service vulnerability existed in django.utils.translation.check_for_language() when processing many distinct, very long language codes. This consumed excessive process memory due to caching. The issue is mitigated by rejecting language codes longer than 500 characters.
- Denial-of-service vulnerability via nested geometry collections
Deeply nested GEOMETRYCOLLECTION objects in GEOSGeometry could lead to a segmentation fault in GEOS. A maximum depth and total number of GEOMETRYCOLLECTIONs (198) is now enforced for WKT and WKB formats, respectively, to mitigate this risk. This limit is customizable.
- Cross-site scripting via URLField values in the admin
URLField values rendered as clickable links in the Django admin were not validated, potentially leading to cross-site scripting if a stored value used a dangerous scheme. URLField values are now validated using URLValidator before rendering as links; otherwise, they are displayed as plain text.
Notes (1) ›
- Security release policy and reporting
Django adheres to a security release policy and requests that potential security issues be reported privately to [email protected]. This announcement details vulnerabilities fixed in Django 6.0.8 and 5.2.17.
https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
Related releases
- FastAPI 0.140.7 Patch Update Improves OpenAPI Dependency Handling FastAPI Releases ·
- Django Software Foundation Hosts Office Hours to Discuss ED Search and Fundraising Django Weblog ·
- Django moves to annual releases with longer support Django Weblog ·
- Django Software Foundation Seeks Executive Director Django Weblog ·
- Django 6.1 Released with Model Field Fetch Modes and DB Delete Options Django Weblog ·
- DSF Member of the Month: Katherine Michel on Django and Community Django Weblog ·