BlueSoybean.com - Free RSS-Based News Reader

In accordance with , the Django team is issuing releases for , , and . These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler

The django.contrib.auth.handlers.modwsgi.check_password() function for authentication via mod_wsgi allowed remote attackers to enumerate users via a timing attack. Thanks to Stackered for the report. This issue has severity "low" according to the Django security policy.

CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI

When receiving duplicates of a single header, ASGIRequest allowed a remote attacker to cause a potential denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-linear computation resulting in service degradation or outage. Thanks to Jiyong Yang for the report. This issue has severity "moderate" according to the Django security policy.

CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS

Raster lookups on GIS fields (only implemented on PostGIS) were subject to SQL injection if untrusted data was used as a band index. As a reminder, all untrusted user input should be validated before use. Thanks to Tarek Nakkouch for the report. This issue has severity "high" according to the Django security policy.

CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

django.utils.text.Truncator.chars() and Truncator.words() methods (with html=True) and truncatechars_html and truncatewords_html template filters were subject to a potential denial-of-service attack via certain inputs with a large number of unmatched HTML end tags, which could cause quadratic time complexity during HTML parsing. Thanks to Seokchan Yoon for the report. This issue has severity "moderate" according to the Django security policy.

CVE-2026-1287: Potential SQL injection in column aliases via control characters

FilteredRelation was subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet methods annotate(), aggregate(), extra(), values(), values_list(), and alias(). Thanks to Solomon Kebede for the report. This issue has severity "high" according to the Django security policy.

CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation

QuerySet.order_by() was subject to SQL injection in column aliases containing periods when the same alias was, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Thanks to Solomon Kebede for the report. This issue has severity "high" according to the Django security policy.

Affected supported versions

• Django main
• Django 6.0
• Django 5.2
• Django 4.2

Resolution

Patches to resolve the issue have been applied to Django's main, 6.0, 5.2, and 4.2 branches. The patches may be obtained from the following changesets.

CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler

• On the
• On the
• On the
• On the

CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI

• On the
• On the
• On the
• On the

CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS

• On the
• On the
• On the
• On the

CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

• On the
• On the
• On the
• On the

CVE-2026-1287: Potential SQL injection in column aliases via control characters

• On the
• On the
• On the
• On the

CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation

• On the
• On the
• On the
• On the

The following releases have been issued

• Django 6.0.2 ( | )
• Django 5.2.11 ( | )
• Django 4.2.28 ( | )

The PGP key ID used for this release is Jacob Walls:

General notes regarding security reporting

As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance, nor via the Django Forum. Please see for further information.

We are thrilled to announce that Djangonaut Space, a mentorship program for contributing to Django, is 🚀 Djangonaut Space is holding a sixth session! This session will start on March 2nd, 2026. We are currently accepting applications until February 2nd, 2026 Anywhere on Earth. More details can be found in the . Djangonaut Space is a free, 8-week group mentoring program where individuals will work self-paced in a semi-structured learning environment. It seeks to help members of the community who wish to level up their current Django code contributions and potentially take on leadership roles in Django in the future.

“I'm so grateful to have been a part of the Djangonaut Space program. It's a wonderfully warm, diverse, and welcoming space, and the perfect place to get started with Django contributions. The community is full of bright, talented individuals who are making time to help and guide others, which is truly a joy to experience. Before Djangonaut Space, I felt as though I wasn't the kind of person who could become a Django contributor; now I feel like I found a place where I belong.” - Eliana, Djangonaut Session 1

Enthusiastic about contributing to Django but wondering what we have in store for you? No worries, we have got you covered! 🤝 ✏️ 📷

For January 2026, we welcome Omar Abou Mrad as our DSF member of the month! ⭐ Omar is a helper in the Django Discord server, he has helped and continuously help folks around the world in their Django journey! He is part of the Discord Staff Team. He has been a DSF member since June 2024. You can learn more about Omar by visiting and . Let’s spend some time getting to know Omar better!

Can you tell us a little about yourself? (hobbies, education, etc)

Hello! My name is Omar Abou Mrad, a 47-year-old husband to a beautiful wife and father of three teenage boys. I’m from Lebanon (Middle East), have a Computer Science background, and currently work as a Technical Lead on a day-to-day basis. I’m mostly high on life and quite enthusiastic about technology, sports, food, and much more! I love learning new things and I love helping people. Most of my friends, acquaintances, and generally people online know me as Xterm.

I have already an idea but where your nickname "Xterm" comes from?

xterm is simply . I first encountered it back in the mid to late 90s when I started using Redhat 2.0 operating system. Things weren’t easy to set up back then, and the terminal was where you spent most of your time. Nevertheless, I had to wait months (or was it years?) on end for the nickname "Xterm" to expire on back in mid 2000s, before I snatched and registered it. Alas, I did! Xterm, c'est moi! >:-]

How did you start using Django?

We landed on Django (~1.1) fairly early at work, as we wanted to use Python with an ORM while building websites for different clients. The real challenge came when we took on a project responsible for managing operations, traceability, and reporting at a pipe-manufacturing company. By that time, most of the team was already well-versed in Django (~1.6), and we went head-on into building one of the most complicated applications we had done to date, everything from the back office to operators’ devices connected to a Django-powered system. Since then, most of our projects have been built with Django at the core. We love Django.

What other framework do you know and if there is anything you would like to have in Django if you had magical powers?

I've used a multitude of frameworks professionally before Django, primarily in Java (EE, SeamFramework, ...) and .NET (ASP.NET, ASP.NET MVC) as well as sampling different frameworks for educational purposes. I suppose if I could snap my fingers and get things to exist in django it wouldn't be something new as much as it is official support of:

• Built-in and opinionated way to deal with hierarchical data in the ORM alongside the supporting API for building and traversing them optimally.
• Built-in websockets support. Essentially the experience.
• Built-in ORM support for common constructs like CTEs, and possibly the ability to transition from raw SQL into a queryset pipeline.

But since we're finger-snapping things to existence, it would be awesome if every component of django (core, orm, templates, forms, "all") could be installed separately in such a way that you could cherry pick what you want to install, so we could dismiss those pesky (cough) arguments (cough) about Django being bulky.

What projects are you working on now?

I'm involved in numerous projects currently at work, most of which are based on Django, but the one I'm working right now consists of doing integrations and synchronizations with for different modules, in different applications. It's quite the challenge, which makes it twice the fun.

Which Django libraries are your favorite (core or 3rd party)?

• hands down. It is an absolute beast of a library and a required tool. It is also the lib that influenced
• obviously, for its numerous helper commands (, ... and much more!)
• while unmaintained, it remains one of my personal favorites for hierarchical data. It's a true piece of art.

I would like to mention that I'm extremely thankful for any and all core and 3rd Party libraries out there!

What are the top three things in Django that you like?

In no particular order:

• The ORM; We love it, it fits nicely with the rest of the components.
• I feel we should not dismiss what sets Django apart from most frameworks; Its defaults, the conventions, and how opinionated it is; If you avoid overriding the defaults that you get, you'll end up with a codebase that anyone can read, understand and maintain easily. (This is quite subjective and some may very well disagree! ^.^)
• The documentation. Django’s documentation is among the best out there: comprehensive, exhaustive, and incredibly well written.

You are helping a lot of folks in Django Discord, what do you think is needed to be a good helper according to you?

First and foremost, I want to highlight what an excellent staff team we have on the . While I don’t feel I hold a candle to what the rest of the team does daily, we complement each other very well. To me, being a good helper means:

• Having patience. You’ve built skills over many years, and not everyone is at the same stage. People will ask unreasonable or incorrect questions, and sometimes they simply won’t listen.
• Guiding people toward figuring things out themselves. Giving a direct solution rarely helps in the long run. There are no scoreboards when it comes to helping others.
• Teaching how to break problems down and reduce noise, especially how to produce the
• Point them to first, and teaching them how to find answers.
• Staying humble. No one knows everything, and you can always learn from your peers.

Dry ORM is really appreciated! What motivated you to create the project?

Imagine you're having a discussion with a djangonaut friend or colleague about some data modeling, or answering some question or concern they have, or reviewing some ORM code in a repository on github, or helping someone on IRC, Slack, Discord, the forums... or simply you want to do some quick ORM experiment but not disturb your current project. The most common ways people deal with this, is by having a throw-away project that they add models to, generate migrations, open the shell, run the queries they want, reset the db if needed, copy the models and the shell code into some code sharing site, then send the link to the recipient. Not to mention needing to store the code they experiment with in either separate scripts or management commands so they can have them as references for later. I loved what DDT gave me with the queries transparency, I loved experimenting in the shell with shell_plus --print-sql and I needed to share things online. All of this was cumbersome and that’s when DryORM came into existence, simplifying the entire process into a single code snippet. The need grew massively when I became a helper on Official Django Discord and noticed we (Staff) could greatly benefit from having this tool not only to assist others, but share knowledge among ourselves. While I never truly wanted to go public with it, I was encouraged by my peers on Discord to share it and since then, they've been extremely supportive and assisted in its evolution. The unexpected thing however, was for DryORM to be used in the , or the , or even in ! Ever since, I've decided to put a lot of focus and effort on having features that can support the django contributors in their quest evolve Django. So here's a shout-out to everyone that use DryORM!

I believe you are the main maintainer, do you need help on something?

Yes, I am and thank you! I think the application has reached a point where new feature releases will slow down, so it’s entering more of a maintenance phase now, which I can manage. Hopefully soon we'll have the discord bot executing ORM snippet :-]

What are your hobbies or what do you do when you’re not working?

Oh wow, not working, what's that like! :-] Early mornings are usually reserved for weight training.\ Followed by a long, full workday.\ Then escorting and watching the kids at practice.\ Evenings are spent with my wife.\ Late nights are either light gaming or some tech-related reading and prototyping.\ Weekends look very similar, just with many more kids sports matches!

Is there anything else you’d like to say?

I want to thank everyone who helped make Django what it is today. If you’re reading this and aren’t yet part of the Discord community, ! You’ll find many like-minded people to discuss your interests with. Whether you’re there to help, get help, or just hang around, it’s a fun place to be.

---

Thank you for doing the interview, Omar!

Today we've issued the and bugfix releases. The release packages and checksums are available from , as well as from the Python Package Index. The PGP key ID used for these releases is Jacob Walls: