Django has 40 CVEs on record between 2020 and 2026. Disclosures have slowed: 5 in the last 90 days after 10 in the 90 before. The busiest recent month was June 2026 with 5. The median CVSS is 5.3 (medium), with 1 rated critical. None have a confirmed exploitation report.

CVEs per month

Weakness classes

Products

Worst active — by depth score

Django vulnerabilities

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

Django: GDALRaster may over-read heap memory when constructed from bytes

Django: cache middleware may expose private responses when unrelated request cookies are present

Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary

Django: signed cookies are vulnerable to salt namespace collisions

Django: has_vary_header may expose cached responses when Vary values contain whitespace

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

Django has an Improper Handling of Length Parameter Inconsistency

Django Uses Cache Containing Sensitive Information

Django vulnerable to privilege abuse in ModelAdmin.list_editable

Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

Django has potential DoS via MultiPartParser through crafted multipart uploads

Django has a Race Condition vulnerability

Django vulnerable to Uncontrolled Resource Consumption

Django has Inefficient Algorithmic Complexity

Django has Inefficient Algorithmic Complexity

Django has Observable Timing Discrepancy

Django is vulnerable to DoS via XML serializer text extraction

Django is vulnerable to SQL injection in column aliases

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

Django is subject to SQL injection through its column aliases

Django Improper Output Neutralization for Logs vulnerability

Django has a denial-of-service possibility in strip_tags()

Django vulnerable to Allocation of Resources Without Limits or Throttling

Django has a potential denial-of-service vulnerability in IPv6 validation

Django SQL injection in HasKey(lhs, rhs) on Oracle

Django denial-of-service in django.utils.html.strip_tags()