An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank sicksec for reporting this issue.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8a0e918188 advisory.

    Update Django 5 to version 5.2.18

    - Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in     get_supported_language_variant()
    - Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing
    - Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values
    - Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys

    See https://docs.djangoproject.com/en/dev/releases/5.2.18/ for more details


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a7b8ff851a advisory.

    Update Django 5 to version 5.2.18

    - Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in     get_supported_language_variant()
    - Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing
    - Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values
    - Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys

    See https://docs.djangoproject.com/en/dev/releases/5.2.18/ for more details


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dbd9eb6961 advisory.

    Update Django 6  to version 6.1.2

    - Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in     get_supported_language_variant()
    - Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing
    - Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values
    - Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys

    See https://docs.djangoproject.com/en/6.1/releases/6.1.2/ for more details


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4626-1 advisory.

    - CVE-2026-77050: potential denial-of-service in `get_supported_language_variant()` when processing many     distinct, very       long language codes (bsc#1284481).
    - CVE-2026-84429: potential denial-of-service attack due to quadratic time complexity when parsing a value     with many       separators inside a quoted parameter (bsc#1284476).
    - CVE-2026-87890: An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who     can supply       `bytes` values to cause the Django process to make network requests via a crafted VRT document     (bsc#1284472).
    - CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting     queryset,       without any permission on the targeted object, marking an out-of-queryset object for deletion     (bsc#1284471).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
    `django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service
    attack when processing many distinct, very long language codes, which are retained as keys in an in-memory
    cache and consume process memory. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x)
    were not evaluated and may also be affected. Django would like to thank Gleb Lizunov for reporting this
    issue. (CVE-2026-77050)

  - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
    `django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to
    quadratic time complexity when parsing a value with many separators inside a quoted parameter. An
    unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for
    instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does
    not bound the combined size of repeated headers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x,
    and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jisung Chae for
    reporting this issue. (CVE-2026-84429)

  - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete
    fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause
    the Django process to make network requests via a crafted VRT document referencing an external raster
    source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may
    also be affected. Django would like to thank sicksec for reporting this issue. (CVE-2026-87890)

  - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
    `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a
    submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An
    object outside that queryset is represented by a newly constructed instance whose primary key can still be
    populated from submitted data when the model's primary key is a field accepted by the form, such as a
    `OneToOneField` or parent link used as the primary key of an inline formset's model, or a natural or UUID
    primary key included in the form's fields. This allows an authenticated user permitted to submit such a
    formset to delete rows outside the limiting queryset, without any permission on the targeted object, via
    forged management-form data marking an out-of-queryset object for deletion. Models using the default
    AutoField primary key are not affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and
    4.2.x) were not evaluated and may also be affected. Django would like to thank Seonggwon Yoon for
    reporting this issue. (CVE-2026-87975)

The detected version of the Django Python package is 5.2.x prior to 5.2.18, or 6.0.x prior to 6.0.9, or 6.1.x prior to 6.1.2. It is, therefore, affected by multiple vulnerabilities, including:

  - django.utils.translation.get_supported_language_variant() is subject to a potential denial-of-service attack     when processing many distinct, very long language codes, which are retained as keys in an in-memory cache and     consume process memory. (CVE-2026-77050)

  - django.utils.http.parse_header_parameters() is subject to a potential denial-of-service attack due to quadratic     time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request     could reach this parsing through headers such as Accept or Content-Type. (CVE-2026-84429)

  - An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to     cause the Django process to make network requests via a crafted VRT document referencing an external raster     source. (CVE-2026-87890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete     fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause     the Django process to make network requests via a crafted VRT document referencing an external raster     source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may     also be affected. Django would like to thank sicksec for reporting this issue. (CVE-2026-87890)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366736	Fedora 44 : python-django5 (2026-8a0e918188)	Nessus	Fedora Local Security Checks	Local	medium
366731	Fedora 43 : python-django5 (2026-a7b8ff851a)	Nessus	Fedora Local Security Checks	Local	medium
366730	Fedora 44 : python-django6 (2026-dbd9eb6961)	Nessus	Fedora Local Security Checks	Local	medium
365322	SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:4626-1)	Nessus	SuSE Local Security Checks	Local	medium
474354	Alpine: multiple py3-django packages: security update to 5.2.18-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
474354	Alpine: multiple py3-django packages: security update to 5.2.18-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
364197	Python Library Django 5.2.x < 5.2.18 / 6.0.x < 6.0.9 / 6.1.x < 6.1.2 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
363420	Linux Distros Unpatched Vulnerability : CVE-2026-87890	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-87890

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium