Django Security Releases: SQLi, DoS, and Username Enumeration Vulnerabilities

Django Security Releases Vulnerabilities CVE-2025-13473: Username Enumeration via Timing Attack Description: The function for authentication via allowed remote attackers to enumerate users via a timing attack. Severity: Low Resolution: Patches applied to all supported branches. CVE-2025-14550: DoS via Repeated Headers in ASGI Description: The class allowed remote attackers to cause a DoS via a crafted request with duplicate headers. Severity: Moderate Resolution: Patches applied to all supported branches. CVE-2026-1207: SQL Injection via Raster Lookups on PostGIS Description: Raster lookups on GIS fields were subject to SQL injection when untrusted data was used as a band index. Severity: High Resolution: Patches applied to all supported branches. CVE-2026-1285: DoS in Truncator HTML Methods Description: The methods were subject to a DoS attack via certain inputs with a large number of unmatched HTML end tags. Severity: Moderate Resolution: Patches applied to all supported branches. CVE-2026-1287: SQL Injection via Column Aliases with Control Characters Description: was subject to SQL injection in column aliases via control characters. Severity: High Resolution: Patches applied to all supported branches. CVE-2026-1312: SQL Injection via and Description: was subject to SQL injection in column aliases containing periods. Severity: High Resolution: Patches applied to all supported branches. Affected Versions Django main Django 6.0 Django 5.2 Django 4.2 Resolution Patches applied to all branches. Downloads Django 6.0.2: Download Django 5.2.11: Download Django 4.2.28: Download Security Reporting Report security issues to security@djangoproject.com.

Goal Reached Thanks to every supporter — we hit 100%!

Django Security Releases: SQLi, DoS, and Username Enumeration Vulnerabilities