Natalia Bidart

The `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()` function, utilized by `django.contrib.gis.forms.GeometryField`, fails to escape invalid submitted values before they are logged. This allows remote attackers to inject or forge log entries by providing a specially crafted geometry value.

An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display for field()` function did not obfuscate the password field of user models other than `AUTH USER MODEL`, or of an `AUTH USER MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.

The `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption. This occurs when processing multipart file uploads that use base64 `Content-Transfer-Encoding`, as the data may be buffered entirely in memory before it is passed to upload handlers.

A denial-of-service issue exists in the `django.utils.http.parse header parameters()` function. The problem arises from quadratic time complexity when parsing values containing numerous separators within a quoted parameter. An unauthenticated attacker can trigger this behavior by sending specially crafted headers, such as `Accept` or `Content-Type`, which are processed during content negotiation by `HttpRequest.accepts()`. The existing per-call length limit fails to restrict the combined size of repeated headers.

An issue exists in the `save existing objects()` function within `django.forms.models.BaseModelFormSet`. The function incorrectly uses the presence of a primary key on a submitted form instance to verify if the instance belongs to the formset's limiting queryset. When a model's primary key is a field accepted by the form—such as a `OneToOneField`, a parent link in an inline formset, or a natural/UUID primary key—an authenticated user can populate the primary key via submitted data. This allows a user to delete rows outside the limiting queryset by forging management-form data, even without permissions for the targeted object. Models using the default AutoField primary key are not affected.

An issue exists where `django.contrib.admin.utils.display for field()` renders `URLField` values as clickable links in the admin interface without proper validation. This allows stored cross-site scripting (XSS) against staff users who click the link if a value with an unsafe scheme is stored in the database. This occurs in applications that persist `URLField` data without running model validation, such as through direct queryset writes, deserialization, or bulk import of untrusted input.

GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. This process allows untrusted input, such as spatial-field filters submitted via the Django admin changelist query string by staff users with view permissions, to reach the constructor. If a `dict` or a `str` containing its JSON representation is provided, it is opened in write mode, enabling an attacker to write a file with a chosen name and content through a file-backed GDAL driver. Other `str` values are treated as datasources, which can trigger outbound network requests via a GDAL virtual filesystem handler. Writing files to locations subsequently imported by the application may lead to remote code execution.

GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects provided as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB. This occurs because the process triggers unbounded recursion, leading to a segmentation fault in the underlying GEOS library. This issue also affects spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field.

A denial-of-service issue exists in the `check for language()` function within `django.utils.translation`. The problem occurs when the function receives numerous distinct and very long language codes, which are stored as keys in an in-memory cache, leading to excessive process memory consumption. These codes are passed to the function via the `set language()` view in `django.views.i18n`, which is not routed by default. Memory consumption is limited by the `DATA UPLOAD MAX MEMORY SIZE` setting and a fixed maximum number of cache entries.

An issue exists where `DomainNameValidator` fails to prohibit newlines in domain names. While `CharField` strips newlines when used via a form field, other implementations may allow them. If an application incorporates these values containing newlines into an HTTP response, header injection can occur. Header injection is a technique used to insert malicious data into HTTP headers, potentially allowing attackers to manipulate the response sent to the client.

`UpdateCacheMiddleware` and the `cache page()` decorator cache responses that vary on cookies when the incoming request contains unrelated cookies. This behavior allows remote attackers to access private data stored in the shared cache.

An issue exists in `django.middleware.cache.UpdateCacheMiddleware` where the `Authorization` header is not added to the `Vary` response header for requests that include that header but lack `Cache-Control: public`. This allows remote attackers to access private cached responses by making unauthenticated requests to the same URL.

An issue exists in the `get signed cookie()` function within `django.http.HttpRequest`. The function employs a non-injective salt derivation by concatenating the cookie name and the salt argument. This allows a remote attacker to use a cookie in a context different from its original signing context by utilizing distinct `name` and `salt` pairs that result in the same concatenated string.

An issue exists in `django.middleware.cache.UpdateCacheMiddleware` where `Cache-Control` response directives are not matched case-insensitively. This allows remote attackers to read responses that were incorrectly cached due to the use of uppercase or mixed-case values in the `Cache-Control` directives.

An issue exists in `django.core.mail.backends.smtp.EmailBackend` where the system fails to prevent the reuse of a partially-initialized connection following a failed `STARTTLS` handshake when the `fail silently` variable is set to `True`. This allows on-path network attackers to intercept and read email content in cleartext.

The `django.utils.cache.has vary header()` function does not strip leading or trailing whitespace from `Vary` response header values before comparison. This allows remote attackers to read cached responses by making requests to URLs that have whitespace-padded `Vary` header values.

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description The `MultiPartParser` component is susceptible to performance degradation when processing multipart uploads containing `Content-Transfer-Encoding: base64` with excessive whitespace. Remote attackers can exploit this to negatively impact system performance. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description ASGI requests lacking or underreporting the `Content-Length` header may bypass the `DATA UPLOAD MAX MEMORY SIZE` limit when processing `HttpRequest.body`, potentially allowing attackers to upload an unrestricted request body into memory. Earlier, unsupported Django versions (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected. Recommendations Update to Django version 4.2.30 or later. Update to Django version 5.2.13 or later. Update to Django version 6.0.4 or later.

A race condition exists in Django's file-system storage and file-based cache backends. This condition can lead to the creation of file system objects with incorrect permissions when concurrent requests are processed in multi-threaded environments. Specifically, a temporary `umask` change made by one thread can affect other threads, resulting in unintended file permissions. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.

The `URLField.to python()` function in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows. This normalization is disproportionately slow for certain Unicode characters, potentially allowing a remote attacker to cause a denial of service by submitting large URL inputs containing these characters.