USN-8154-1: Django vulnerabilities

USN-8154-1: Django vulnerabilities

Publication date: 7 April 2026
Overview: Several security issues were fixed in Django.

Packages
python-django - High-level Python web development framework

Details
Seokchan Yoon discovered that Django incorrectly handled copying memory
when parsing multipart uploads with excessive whitespace. A remote attacker
could possibly use this issue to cause Django to use excessive resources,
leading to a denial of service. (CVE-2026-33033)

It was discovered that Django did not enforce an upload memory size limit
in the Content-Length header. A remote attacker could possibly use this
issue to cause Django to use excessive resources, leading to a denial of
service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10.
(CVE-2026-33034)

Tarek Nakkouch discovered that Django incorrectly handled underscores in
the ASGI headers. A remote attacker could possibly use this issue to spoof
HTTP headers. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,
and Ubuntu 25.10. (CVE-2026-3902)

It was discovered that Django incorrectly handled verification of model
data created with POST requests. A remote attacker could possibly use this
issue to forge new model permissions. (CVE-2026-4277, CVE-2026-4292)

Update instructions
The problem can be corrected by updating your system to the following package versions:

25.10 questing

• python3-django – 3:5.2.4-1ubuntu2.4

24.04 LTS noble

• python3-django – 3:4.2.11-1ubuntu1.15

22.04 LTS jammy

• python3-django – 2:3.2.12-2ubuntu1.26

20.04 LTS focal

• python3-django – 2:2.2.12-1ubuntu0.29+esm8

18.04 LTS bionic

• python-django – 1:1.11.11-1ubuntu1.21+esm15
• python3-django – 1:1.11.11-1ubuntu1.21+esm15