An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Gleb Lizunov for reporting this issue.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4843 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4843-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     October 19, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 3:3.2.25-0+deb12u6     CVE ID         : CVE-2026-77050 CVE-2026-87975

    Two vulnerabilities were discovered in Django, the popular Python     web-development framework.

    CVE-2026-77050

        Potential denial-of-service vulnerability in         get_supported_language_variant. This method was subject to a         potential denial-of-service attack when processing many distinct         and very long language codes. Language codes were used as keys in         an in-memory cache before their length was limited, potentially         consuming excessive process memory. To mitigate this         vulnerability, language codes longer than 500 characters are now         rejected or truncated before the cached lookup.

    CVE-2026-87975

        Prevent privilege abuse in model formsets with editable primary         keys. Model formsets incorrectly allowed forged POST data to         either delete instances outside the limiting queryset or create         instances via edit-only formsets when the model's primary key         could be set through the form, such as with a OneToOneField (or         parent link used as the primary key of an inline formset's         model), or a natural or UUID primary key included in the form's         fields. Models using the default BigAutoField primary key were         not affected.

    For Debian 12 bookworm, these problems have been fixed in version     3:3.2.25-0+deb12u6.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8a0e918188 advisory.

    Update Django 5 to version 5.2.18

    - Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in     get_supported_language_variant()
    - Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing
    - Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values
    - Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys

    See https://docs.djangoproject.com/en/dev/releases/5.2.18/ for more details


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a7b8ff851a advisory.

    Update Django 5 to version 5.2.18

    - Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in     get_supported_language_variant()
    - Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing
    - Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values
    - Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys

    See https://docs.djangoproject.com/en/dev/releases/5.2.18/ for more details


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dbd9eb6961 advisory.

    Update Django 6  to version 6.1.2

    - Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in     get_supported_language_variant()
    - Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing
    - Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values
    - Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys

    See https://docs.djangoproject.com/en/6.1/releases/6.1.2/ for more details


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4626-1 advisory.

    - CVE-2026-77050: potential denial-of-service in `get_supported_language_variant()` when processing many     distinct, very       long language codes (bsc#1284481).
    - CVE-2026-84429: potential denial-of-service attack due to quadratic time complexity when parsing a value     with many       separators inside a quoted parameter (bsc#1284476).
    - CVE-2026-87890: An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who     can supply       `bytes` values to cause the Django process to make network requests via a crafted VRT document     (bsc#1284472).
    - CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting     queryset,       without any permission on the targeted object, marking an out-of-queryset object for deletion     (bsc#1284471).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
    `django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service
    attack when processing many distinct, very long language codes, which are retained as keys in an in-memory
    cache and consume process memory. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x)
    were not evaluated and may also be affected. Django would like to thank Gleb Lizunov for reporting this
    issue. (CVE-2026-77050)

  - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
    `django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to
    quadratic time complexity when parsing a value with many separators inside a quoted parameter. An
    unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for
    instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does
    not bound the combined size of repeated headers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x,
    and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jisung Chae for
    reporting this issue. (CVE-2026-84429)

  - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete
    fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause
    the Django process to make network requests via a crafted VRT document referencing an external raster
    source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may
    also be affected. Django would like to thank sicksec for reporting this issue. (CVE-2026-87890)

  - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
    `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a
    submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An
    object outside that queryset is represented by a newly constructed instance whose primary key can still be
    populated from submitted data when the model's primary key is a field accepted by the form, such as a
    `OneToOneField` or parent link used as the primary key of an inline formset's model, or a natural or UUID
    primary key included in the form's fields. This allows an authenticated user permitted to submit such a
    formset to delete rows outside the limiting queryset, without any permission on the targeted object, via
    forged management-form data marking an out-of-queryset object for deletion. Models using the default
    AutoField primary key are not affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and
    4.2.x) were not evaluated and may also be affected. Django would like to thank Seonggwon Yoon for
    reporting this issue. (CVE-2026-87975)

The detected version of the Django Python package is 5.2.x prior to 5.2.18, or 6.0.x prior to 6.0.9, or 6.1.x prior to 6.1.2. It is, therefore, affected by multiple vulnerabilities, including:

  - django.utils.translation.get_supported_language_variant() is subject to a potential denial-of-service attack     when processing many distinct, very long language codes, which are retained as keys in an in-memory cache and     consume process memory. (CVE-2026-77050)

  - django.utils.http.parse_header_parameters() is subject to a potential denial-of-service attack due to quadratic     time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request     could reach this parsing through headers such as Accept or Content-Type. (CVE-2026-84429)

  - An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to     cause the Django process to make network requests via a crafted VRT document referencing an external raster     source. (CVE-2026-87890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
    `django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service     attack when processing many distinct, very long language codes, which are retained as keys in an in-memory     cache and consume process memory. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x)     were not evaluated and may also be affected. Django would like to thank Gleb Lizunov for reporting this     issue. (CVE-2026-77050)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367758	Debian dla-4843 : python-django-doc - security update	Nessus	Debian Local Security Checks	Local	medium
366736	Fedora 44 : python-django5 (2026-8a0e918188)	Nessus	Fedora Local Security Checks	Local	medium
366731	Fedora 43 : python-django5 (2026-a7b8ff851a)	Nessus	Fedora Local Security Checks	Local	medium
366730	Fedora 44 : python-django6 (2026-dbd9eb6961)	Nessus	Fedora Local Security Checks	Local	medium
365322	SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:4626-1)	Nessus	SuSE Local Security Checks	Local	medium
474354	Alpine: multiple py3-django packages: security update to 5.2.18-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
474354	Alpine: multiple py3-django packages: security update to 5.2.18-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
364197	Python Library Django 5.2.x < 5.2.18 / 6.0.x < 6.0.9 / 6.1.x < 6.1.2 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
363419	Linux Distros Unpatched Vulnerability : CVE-2026-77050	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-77050

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium