Django Releases Security Updates 6.1.3, 6.0.10, and 5.2.19 Addressing Multiple CVEs

New Security Releases Issued

The Django project has announced the immediate availability of security releases Django 6.1.3, 6.0.10, and 5.2.19. These updates are critical and address several security vulnerabilities identified in previous versions of the framework. All Django users are strongly encouraged to upgrade their applications to these new versions as soon as possible to ensure continued security.

Memory Exhaustion Vulnerability (CVE-2026-108147)

A low-severity vulnerability, CVE-2026-108147, was found in django.http.multipartparser.MultiPartParser. This issue could lead to potential memory exhaustion. Specifically, multipart uploads using Content-Transfer-Encoding: base64 could be buffered entirely in memory before being processed by upload handlers, bypassing FILE_UPLOAD_MAX_MEMORY_SIZE limits and potentially consuming excessive system memory. Ignacy Kujawa reported this issue.

Log Injection Flaw (CVE-2026-111211)

Another low-severity issue, CVE-2026-111211, affects django.contrib.gis.forms.GeometryField and its associated widgets. Invalid submitted values were logged directly without proper escaping, allowing control characters like newlines or ANSI escape sequences to be written into log files. This could enable log injection or forgery, potentially manipulating log appearance or structure, especially when logs are processed by external systems or viewed in terminals. Aaron chen reported this vulnerability.

Server-Side Request Forgery (CVE-2026-111362)

A moderate-severity vulnerability, CVE-2026-111362, was discovered related to server-side request forgery (SSRF) via the crs member of GeoJSON geometries. Older GeoJSON specifications allowed specifying a Coordinate Reference System (CRS) by URL. Since GDAL still resolves these URLs, an attacker could submit a malicious CRS when a geometry was instantiated from user input. This could cause the Django process to make network requests or read local files. Django now rejects GeoJSON geometries with CRS references to external resources in lookups against spatial fields, GeometryField, and GEOSGeometry, while DataSource and LayerMapping continue to accept them for trusted data. This was reported by Submersion Security Research Team.

Private Data Exposure (CVE-2026-113593)

CVE-2026-113593 addresses a potential exposure of private data. UpdateCacheMiddleware and cache_page() generated the same cache key for requests where a header listed in the response's Vary header was omitted, and requests where that header was sent with an empty value. This could lead to incorrect caching and potential exposure of sensitive information.