UnratedFix available

Django security releases issued: 6.1.2, 6.0.9, and 5.2.18

Type: patchSources: Django weblog

Django 6.1.2, 6.0.9, and 5.2.18 address security issues including denial-of-service vulnerabilities, request forgery, and privilege abuse. The release also strengthens an earlier mitigation for nested geometry collections.

Products: Django
Affected versions: Django 5.2, Django 6.0, Django 6.1, Django main
Fixed versions: Django 5.2.18, Django 6.0.9, Django 6.1.2
CVEs: CVE-2026-15830, CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, CVE-2026-87975
Confirmed fixed CVEs: Not specified
Updated in this feed: 31 Oct 2026, 11:30 UTC · Revision 1

Source evidence

Django security releases issued: 6.1.2, 6.0.9, and 5.2.18

official-django-weblog · Original source

Published 6 Oct 2026, 13:00 UTC

These releases address the security issues detailed below.

Django

Fixed versions: Django 6.1.2, Django 6.0.9, Django 5.2.18

Complete source record

{
  "id": "8f2157c7fa5d3c45f3134fbcd5ab318db0c5416a45dffd0aaf3113fe3976752e",
  "url": "https://www.djangoproject.com/weblog/2026/oct/06/security-releases/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Django security releases issued: 6.1.2, 6.0.9, and 5.2.18",
    "summary": "Django 6.1.2, 6.0.9, and 5.2.18 address security issues including denial-of-service vulnerabilities, request forgery, and privilege abuse. The release also strengthens an earlier mitigation for nested geometry collections.",
    "evidence": "These releases address the security issues detailed below.",
    "products": [
      {
        "name": {
          "value": "Django",
          "evidence": "Django 6.1.2, Django 6.0.9, and Django 5.2.18"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "Django 6.1.2",
            "evidence": "Django 6.1.2 (tarball | checksums)"
          },
          {
            "value": "Django 6.0.9",
            "evidence": "Django 6.0.9 (tarball | checksums)"
          },
          {
            "value": "Django 5.2.18",
            "evidence": "Django 5.2.18 (tarball | checksums)"
          }
        ],
        "affected_versions": [
          {
            "value": "Django main",
            "evidence": "Django main"
          },
          {
            "value": "Django 6.1",
            "evidence": "Django 6.1"
          },
          {
            "value": "Django 6.0",
            "evidence": "Django 6.0"
          },
          {
            "value": "Django 5.2",
            "evidence": "Django 5.2"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-77050",
        "evidence": "CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant()"
      },
      {
        "value": "CVE-2026-84429",
        "evidence": "CVE-2026-84429: Potential denial-of-service vulnerability in HTTP header parsing"
      },
      {
        "value": "CVE-2026-87890",
        "evidence": "CVE-2026-87890: Potential request forgery via spatial lookup byte values"
      },
      {
        "value": "CVE-2026-87975",
        "evidence": "CVE-2026-87975: Privilege abuse in model formsets with editable primary keys"
      },
      {
        "value": "CVE-2026-15830",
        "evidence": "Followup to CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-django-weblog",
  "document_id": 23437,
  "published_at": "2026-10-06T13:00:00+00:00"
}