Detections
Analytics
Alpine: multiple py3-django packages: security update to 5.2.18-r0
medium Tenable Self-Hosted Container Security Plugin ID 474354
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service
attack when processing many distinct, very long language codes, which are retained as keys in an in-memory
cache and consume process memory. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x)
were not evaluated and may also be affected. Django would like to thank Gleb Lizunov for reporting this
issue. (CVE-2026-77050)
- An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to
quadratic time complexity when parsing a value with many separators inside a quoted parameter. An
unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for
instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does
not bound the combined size of repeated headers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x,
and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jisung Chae for
reporting this issue. (CVE-2026-84429)
- An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete
fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause
the Django process to make network requests via a crafted VRT document referencing an external raster
source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may
also be affected. Django would like to thank sicksec for reporting this issue. (CVE-2026-87890)
- An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a
submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An
object outside that queryset is represented by a newly constructed instance whose primary key can still be
populated from submitted data when the model's primary key is a field accepted by the form, such as a
`OneToOneField` or parent link used as the primary key of an inline formset's model, or a natural or UUID
primary key included in the form's fields. This allows an authenticated user permitted to submit such a
formset to delete rows outside the limiting queryset, without any permission on the targeted object, via
forged management-form data marking an out-of-queryset object for deletion. Models using the default
AutoField primary key are not affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and
4.2.x) were not evaluated and may also be affected. Django would like to thank Seonggwon Yoon for
reporting this issue. (CVE-2026-87975)
Solution
Update the py3-django library and its related packages to version 5.2.18-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2026-77050
https://security.alpinelinux.org/vuln/CVE-2026-84429
Plugin Details
Severity: Medium
ID: 474354
Version: Revision 1.1
Type: Local
Published: 10/12/2026
Updated: 10/12/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Low
Score: 3.2
Percentile: 50.39
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2026-87890
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6.9
Threat Score: 2.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 10/6/2026
Reference Information
CVE: CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, CVE-2026-87975