Hi,

The following vulnerabilities were published for python-django:

CVE-2026-108147

    Potential memory exhaustion in MultiPartParser via base64-encoded file
    upload When using django.http.multipartparser.MultiPartParser, multipart
    uploads with Content-Transfer-Encoding: base64 could be buffered entirely
    in memory, regardless of FILE_UPLOAD_MAX_MEMORY_SIZE, before being passed
    to upload handlers, potentially consuming excessive memory.

CVE-2026-111211

    Potential log injection via unescaped geometry form values
    django.contrib.gis.forms.GeometryField and its widgets logged invalid
    submitted values directly, allowing control characters (e.g. newlines or
    ANSI escape sequences) to be written unescaped into logs. This could enable
    log injection or forgery, letting attackers manipulate log appearance or
    structure, especially in logs processed by external systems or viewed in
    terminals.

CVE-2026-111362

    Server-side request forgery via crs member of GeoJSON geometries Earlier
    versions of the GeoJSON spec allowed specifying a coordinate reference
    system (CRS) by URL. Since GDAL still resolves these URLs, any validation,
    save, or query path where a geometry is instantiated from user input
    allowed an attacker to submit a malicious CRS that would make a network
    request as the Django process user, or read a file, or both.

    Lookups against spatial fields, the GeometryField form field, and
    GEOSGeometry now reject GeoJSON geometries with CRS references to external
    resources. The DataSource and LayerMapping utilities for loading trusted
    data continue to accept these values.

CVE-2026-113593

    Potential exposure of private data via empty and missing Vary headers
    UpdateCacheMiddleware and cache_page() generated the same cache key for a
    request that omitted a header listed in the response's Vary header and a
    request that sent that header with an empty value. As a result, a response
    cached for one of these requests could be served to the other, which could
    lead to the exposure of private data.

    Cache keys now distinguish between absent and empty header values, as
    required by RFC 9111#section-4.1.

    Responses previously cached for requests that omitted a header listed in
    Vary will no longer be matched, and will be cached again on the next
    request.

CVE-2026-113733

    Password hash disclosure to "view only" admin users with custom user models
    Admin users with the view (but not change) permission to a user model were
    displayed the entire password hash when the model was not AUTH_USER_MODEL,
    or when AUTH_USER_MODEL inherited its password field from a concrete parent
    model through multi-table inheritance.

CVE-2026-114582

    Server-side request forgery via SpatialReference string input
    SpatialReference passed string input to GDAL, which by default resolves
    URLs and reads files. This behavior was not documented by Django. Other
    affected methods included GEOSGeometry.transform(),
    OGRGeometry.transform(), GDALRaster.transform(), the srs setter of
    OGRGeometry, and the srs and srid setters of GDALRaster. A URL or file path
    reaching any of these would issue an outbound request or read a file as the
    Django process user. The attack vectors could be combined to reveal local
    file contents by observing outbound requests.

    SpatialReference now disables network and file access when parsing string
    input on GDAL 3.9 and later. As a consequence, file paths and URLs are no
    longer accepted as SpatialReference inputs. Dictionary references using the
    DICT: prefix, including those prefixed with ESRI::, are rejected on all
    GDAL versions.

    Full protection requires GDAL 3.9 or later. Integer SRIDs are looked up
    directly in the EPSG database, so prefer them when the input is untrusted.
    Or, if strings must be used on lower GDAL versions, compare to an allow
    list. The new gis.W001 system check warns when the installed version of
    GDAL is not at least 3.9.

For further information see:

https://www.djangoproject.com/weblog/2026/nov/03/security-releases/


Regards,

We believe that the bug you reported is fixed in the latest version of
python-django, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152952@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <lamby@debian.org> (supplier of updated python-django package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 03 Nov 2026 12:52:52 -0800
Source: python-django
Built-For-Profiles: nocheck
Architecture: source
Version: 3:5.2.19-1
Distribution: unstable
Urgency: high
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Closes: 1152952
Changes:
 python-django (3:5.2.19-1) unstable; urgency=high
 .
   * New upstream security release:
 .
     - CVE-2026-108147: Prevent a potential memory exhaustion in MultiPartParser
       via base64-encoded file uploads. When using django.http.multipartparser's
       MultiPartParser, multipart uploads with a "Content-Transfer-Encoding:
       base64" header could be buffered entirely in memory regardless of the
       value of FILE_UPLOAD_MAX_MEMORY_SIZE before being passed to upload
       handlers, potentially consuming excessive memory.
 .
     - CVE-2026-111211: Avoid a potential log injection via unescaped geometry
       form values. django.contrib.gis.forms.GeometryField (and its widgets)
       logged invalid submitted values directly, allowing control characters
       (e.g. newlines or ANSI escape sequences) to be written unescaped into
       logs. This could have enabled log injection or forgery, letting attackers
       manipulate log appearances and structures, especially in logs processed
       by external systems or when viewed in terminals.
 .
     - CVE-2026-111362: Fix a server-side request forgery via the 'crs' member
       of GeoJSON geometries. Earlier versions of the GeoJSON spec allowed
       specifying a coordinate reference system (CRS) by URL. Since GDAL still
       resolves these URLs, any validation, save or query path where a geometry
       is instantiated from user input allowed an attacker to submit a malicious
       CRS that would make a network request as the Django process user or read
       a file (or both). Lookups against spatial fields, the GeometryField form
       field and GEOSGeometry now reject GeoJSON geometries with CRS references
       to external resources. The DataSource and LayerMapping utilities for
       loading trusted data continue to accept these values, however.
 .
     - CVE-2026-113593: Avoid a potential exposure of private data via empty and
       missing 'Vary' headers. UpdateCacheMiddleware and cache_page() generated
       the same cache key for a request that omitted a header listed in the
       response's 'Vary' header and a request that sent that header with an
       empty value. As a result, a response cached for one of these requests
       could be served to the other which could lead to the exposure of private
       data. Cache keys now distinguish between absent and empty header values
       as required by RFC 9111#section-4.1. Responses previously cached for
       requests that omitted a header listed in 'Vary' will no longer be
       matched and will be cached again on the next request.
 .
     - CVE-2026-113733: Fix a password hash disclosure to "view only" admin
       users with custom user models. Admin users with the 'view' (but not
       'change') permission to a user model were shown the entire password hash
       when the model was not AUTH_USER_MODEL (or when AUTH_USER_MODEL inherited
       its password field from a concrete parent model through multi-table
       inheritance).
 .
     - CVE-2026-114582: Avoid a server-side request forgery via SpatialReference
       string input. SpatialReference passed string input to GDAL, which by
       default resolves URLs and reads files. This behavior was not previously
       documented by Django. (Other affected methods included
       GEOSGeometry.transform, OGRGeometry.transform, GDALRaster.transform, the
       srs setter of OGRGeometry and the srs and srid setters of GDALRaster.) A
       URL or file path reaching any of these would issue an outbound request or
       read a file as the Django process user. The attack vectors could be
       combined to reveal local file contents by observing outbound requests.
       SpatialReference now disables network and file access when parsing string
       input on GDAL 3.9 and later. As a consequence, file paths and URLs are no
       longer accepted as SpatialReference inputs. Dictionary references using
       the DICT: prefix, including those prefixed with 'ESRI::', are rejected on
       all GDAL versions. Full protection requires GDAL 3.9 or later, and a new
       gis.W001 system check warns when the installed version of GDAL is not at
       least 3.9.
 .
     <https://www.djangoproject.com/weblog/2026/nov/03/security-releases/>
 .
     (Closes: #1152952)
Checksums-Sha1:
 7228bbd29fbfbce231f3ca7043908937117666e2 2790 python-django_5.2.19-1.dsc
 ba8f4f4dcbd53c27cc26f38a17d20dfd14ac8a30 10969285 python-django_5.2.19.orig.tar.gz
 054da697ec25f64d65dcbb3d86baa1e36ff543d5 45168 python-django_5.2.19-1.debian.tar.xz
 4372f4ead8ae5752bfa32d39ba79a9e24facde2f 7807 python-django_5.2.19-1_amd64.buildinfo
Checksums-Sha256:
 4f48e4f231f3f43cc7d8a87bb75f4fcae7104fe63a7801bc49f0094d21000621 2790 python-django_5.2.19-1.dsc
 ad03d8abc51dbff95ebf34b27123cf0c26a3b62db7ba0cd520783686362533d1 10969285 python-django_5.2.19.orig.tar.gz
 ed010415959d871b1844c251f64d872b0f52b45a49d2644988c1f7c0dfee4e18 45168 python-django_5.2.19-1.debian.tar.xz
 866dd134e79b8a822358db751400c8c123e5afbbb35988d5c55440ce7692195f 7807 python-django_5.2.19-1_amd64.buildinfo
Files:
 bbf35495cba4199c7ebc735fcc0d1557 2790 python optional python-django_5.2.19-1.dsc
 48e88356608f080fa460259205e88487 10969285 python optional python-django_5.2.19.orig.tar.gz
 88441c49da56c1338331de260a86901d 45168 python optional python-django_5.2.19-1.debian.tar.xz
 d8bf50f1ef24397eacdb9446d3cf8789 7807 python optional python-django_5.2.19-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmrqSmMACgkQHpU+J9Qx
Hli+/RAAm4v2S04FGfwbDFX91P09qU3V3HZZzcHliaVFCdFOpwKAc2kZVqG7Y2VX
b4uF1fHy2gAAy/j787mTdxg+OOvvxAXghzX3OBuHXxNWAwXnJXYuZYHzvR3ArKQe
je/bmLUgQJQi4HD/xpPdMiOKiHVM5+p3t/kbXGuoaKQk+Obj3+SAucAAxLVIvN3i
1O2plRb+dIRjPfyWITIeuFL6bMHOsGwJlNQ20Ec9ZVZt+BFGYaQ+jzd9SF6uSOHG
ymn2kJYTUr7D8BHM5d+epyhod8ceULVNLTFimH/PKrFjzc2aAWpMbZMrnn8FD03E
8ZLzAArmNTN09i989YO6imajNdvTSWnazB3UCJc7ztQZ1kBFysh0suG0t1C1AiKa
kiH8GiAZaikzo/Jp1laeLSfb9dPsFuwIH93hCz4Da3QeVuq/gbD+mNb07vawNdPs
vT2/ByaUMbyyN4BcvrX/C8N6Agh/jt47fBELViSXU6eSoZIA4h9ShkbKwH0a2XvO
mcFXMFNdUm9kPi07A3DymAV+bMLLq0McBXMbil8exofPb8yQZNq1FlqYtFpCUBwl
Ysdvf8sL8hTnQu6MgZkCK01X6AH26aoA3sowSrTYk76bvNRp7Dpi1VHHif+TXtdv
VM0SCn4JkVTaLoJzh9TQF0F7+WrQnn3ny7IQY6YbV8Isj+HXSOQ=
=y2SP
-----END PGP SIGNATURE-----

Hi Chris,
[...]

This should be only from 6.0 onwards, is this correct?

Regards,
Salvatore

Salvatore Bonaccorso wrote:

Yes, you are correct. I misparsed the issue due to the way it is phrasded — prior
to Django 6.0, the admin does no obfuscation of the hash (which is not ideal, but
a trivial issue). It is therefore not vulnerable in trixie either of course. (I
haven't checked the other CVEs yet.)

The changelog uploaded to sid is therefore misleading. I can fix that in a future
upload, but shall I split this bug into two so you can track this more precisely
in the BTS, or is marking it as such in the security tracker enough?


Regards,

Hi Chris,

Thanks a lot for the confirmation. No no need to split up the bug, we
should have all in order from security-tracker point of view now and
it fine. We will followup to your question shortly about the update in
trixie.

Regards,
Salvatore