# Django Software Foundation vulnerabilities Source: https://junglewise.ai/threats/vendors/django-software-foundation Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/django-software-foundation.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 45 vulnerabilities in Django Software Foundation: 0 in the last 7 days and 10 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114582, was published on 3 November 2026. 6 vulnerabilities in the last four weeks, up 50% on the four before (4). 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 10 - All time: 45 (2 critical, 0 exploited in the wild) ## About Django Software Foundation A non-profit organization that supports and maintains the Django web framework. ## Latest Django Software Foundation vulnerabilities - [CVE-2026-114582: Django GIS spatial reference string injection](https://junglewise.ai/threats/cve-2026-114582-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6) (medium, CVSS 5.3, published 3 Nov 2026) - [CVE-2026-111362: Django SSRF in GeoJSON coordinate reference systems](https://junglewise.ai/threats/cve-2026-111362-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6) (medium, CVSS 5.3, published 3 Nov 2026) - [CVE-2026-111211: Django log injection in BaseGeometryWidget.deserialize()](https://junglewise.ai/threats/cve-2026-111211-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6) (medium, CVSS 5.3, published 3 Nov 2026) - [CVE-2026-108147: Django multipart parser excessive memory consumption via base64 Content-Transfer-Encoding](https://junglewise.ai/threats/cve-2026-108147-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-4-before) (medium, CVSS 5.3, published 3 Nov 2026) - [CVE-2026-114137: Django REST framework token deletion bypass](https://junglewise.ai/threats/cve-2026-114137-django-rest-framework-is-a-toolkit-for-building-web-apis-from-3) (high, CVSS 7.4, published 21 Oct 2026) - [CVE-2026-114136: Django REST framework memory amplification via charset codec](https://junglewise.ai/threats/cve-2026-114136-django-rest-framework-is-a-toolkit-for-building-web-apis-from-3) (high, CVSS 7.5, published 21 Oct 2026) - [CVE-2026-87975: Django authorization bypass in BaseModelFormSet deletion](https://junglewise.ai/threats/cve-2026-87975-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0) (medium, CVSS 4.3, published 6 Oct 2026) - [CVE-2026-87890: Django spatial lookups SSRF via crafted VRT document](https://junglewise.ai/threats/cve-2026-87890-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0) (medium, CVSS 5.3, published 6 Oct 2026) - [CVE-2026-84429: Django parse_header_parameters denial of service](https://junglewise.ai/threats/cve-2026-84429-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0) (medium, CVSS 5.3, published 6 Oct 2026) - [CVE-2026-77050: Django language code processing denial-of-service](https://junglewise.ai/threats/cve-2026-77050-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0) (medium, CVSS 5.3, published 6 Oct 2026) - [CVE-2026-73229: Django REST framework AdminRenderer permission bypass information disclosure](https://junglewise.ai/threats/cve-2026-73229-django-rest-framework-adminrenderer-permission-bypass-information) (medium, CVSS 4.3, published 11 Aug 2026) - [CVE-2026-73228: Django REST Framework DATA_UPLOAD_MAX_MEMORY_SIZE bypass in request.data](https://junglewise.ai/threats/cve-2026-73228-django-rest-framework-data-upload-max-memory-size-bypass-in) (medium, CVSS 5.3, published 11 Aug 2026) - [CVE-2026-15830: Django GeoDjango unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service) (medium, CVSS 5.3, published 4 Aug 2026) - [CVE-2026-53878: Django DomainNameValidator header injection via newline characters](https://junglewise.ai/threats/cve-2026-53878-django-domainnamevalidator-header-injection-via-newline) (medium, CVSS 6.1, published 7 Jul 2026) - [CVE-2026-53877: Django GDALRaster heap buffer over-read in GIS component](https://junglewise.ai/threats/cve-2026-53877-django-gdalraster-heap-buffer-over-read-in-gis-component) (medium, CVSS 4.8, published 7 Jul 2026) - [CVE-2026-48588: Django private data exposure in UpdateCacheMiddleware caching](https://junglewise.ai/threats/cve-2026-48588-django-private-data-exposure-in-updatecachemiddleware-caching) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-8404: Django UpdateCacheMiddleware information disclosure via case-sensitive headers](https://junglewise.ai/threats/cve-2026-8404-django-updatecachemiddleware-information-disclosure-via-case) (low, CVSS 3.1, published 3 Jun 2026) - [CVE-2026-7666: Django cleartext email transmission in SMTP EmailBackend](https://junglewise.ai/threats/cve-2026-7666-django-cleartext-email-transmission-in-smtp-emailbackend) (medium, CVSS 4, published 3 Jun 2026) - [CVE-2026-6873: Django salt namespace collision in get_signed_cookie](https://junglewise.ai/threats/cve-2026-6873-django-salt-namespace-collision-in-get-signed-cookie) (low, CVSS 3.1, published 3 Jun 2026) - [CVE-2026-48587: Django information disclosure via whitespace padding in Vary header](https://junglewise.ai/threats/cve-2026-48587-django-information-disclosure-via-whitespace-padding-in-vary) (low, CVSS 3.1, published 3 Jun 2026) - [CVE-2026-44546: Django Daphne header injection in WebSocket handshake](https://junglewise.ai/threats/cve-2026-44546-django-daphne-header-injection-in-websocket-handshake) (low, CVSS 3.7, published 3 Jun 2026) - [CVE-2026-44545: Django Daphne denial of service via unlimited WebSocket payload size](https://junglewise.ai/threats/cve-2026-44545-django-daphne-denial-of-service-via-unlimited-websocket-payload) (medium, CVSS 5.3, published 3 Jun 2026) - [CVE-2026-35193: Django UpdateCacheMiddleware information disclosure via missing Vary header](https://junglewise.ai/threats/cve-2026-35193-django-updatecachemiddleware-information-disclosure-via-missing) (medium, CVSS 4, published 3 Jun 2026) - [CVE-2026-6907: Django incorrect caching of sensitive information in UpdateCacheMiddleware](https://junglewise.ai/threats/cve-2026-6907-django-incorrect-caching-of-sensitive-information-in) (medium, CVSS 4.3, published 5 May 2026) - [CVE-2026-5766: Django Improper Handling of Length Parameter Inconsistency in ASGI requests](https://junglewise.ai/threats/cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi) (medium, CVSS 5.3, published 5 May 2026) ## Most severe Django Software Foundation vulnerabilities - [CVE-2026-4277: Django missing authorization in GenericInlineModelAdmin](https://junglewise.ai/threats/cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin) (critical, CVSS 9.8, published 7 Apr 2026) - [CVE-2025-64459: Django SQL injection in QuerySet and Q objects via _connector argument](https://junglewise.ai/threats/cve-2025-64459-django-sql-injection-in-queryset-and-q-objects-via-connector) (critical, CVSS 9.1, published 5 Nov 2025) - [CVE-2025-64460: Django denial of service in XML serializer text extraction](https://junglewise.ai/threats/cve-2025-64460-django-denial-of-service-in-xml-serializer-text-extraction) (high, CVSS 7.5, published 2 Dec 2025) - [CVE-2025-64458: Django denial of service in HttpResponseRedirect on Windows](https://junglewise.ai/threats/cve-2025-64458-django-denial-of-service-in-httpresponseredirect-on-windows) (high, CVSS 7.5, published 5 Nov 2025) - [CVE-2026-25673: Django denial of service in URLField via Unicode normalization on Windows](https://junglewise.ai/threats/cve-2026-25673-django-denial-of-service-in-urlfield-via-unicode-normalization-on) (high, CVSS 7.5, published 3 Mar 2026) - [CVE-2026-33034: Django memory limit bypass in ASGI requests](https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests) (high, CVSS 7.5, published 7 Apr 2026) - [CVE-2026-3902: Django ASGI header spoofing via underscore/hyphen conflation](https://junglewise.ai/threats/cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation) (high, CVSS 7.5, published 7 Apr 2026) - [CVE-2026-114136: Django REST framework memory amplification via charset codec](https://junglewise.ai/threats/cve-2026-114136-django-rest-framework-is-a-toolkit-for-building-web-apis-from-3) (high, CVSS 7.5, published 21 Oct 2026) - [CVE-2026-114137: Django REST framework token deletion bypass](https://junglewise.ai/threats/cve-2026-114137-django-rest-framework-is-a-toolkit-for-building-web-apis-from-3) (high, CVSS 7.4, published 21 Oct 2026) - [CVE-2025-57833: Django SQL injection in FilteredRelation column aliases](https://junglewise.ai/threats/cve-2025-57833-django-sql-injection-in-filteredrelation-column-aliases) (high, CVSS 7.1, published 8 Sep 2025) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up 50% on the four before (4). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 4 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 4 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Django Software Foundation technologies - [Django Software Foundation Django](https://junglewise.ai/threats/technologies/django-software-foundation-django): 38 vulnerabilities - [Django Software Foundation Django REST framework](https://junglewise.ai/threats/technologies/django-rest-framework): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Django Software Foundation vulnerabilities", https://junglewise.ai/threats/vendors/django-software-foundation, 11 November 2026.