MGASA-2026-0591: Updated python-django package fixes security vulnerabilities
CVE-2026-108147: Potential memory exhaustion in MultiPartParser via base64-encoded file upload CVE-2026-111211: Potential log injection via unescaped geometry form values CVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometries CVE-2026-113593: Potential exposure of private data via empty and missing Vary headers CVE-2026-113733: Password hash disclosure to "view only" admin users with custom user models CVE-2026-114582: Server-side request forgery via SpatialReference string input
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/python-djangoto a version that resolves this vulnerability.Fixed in 5.2.19-1.mga10
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Django features are implicated by these issues?
The affected areas include MultiPartParser handling of base64-encoded file uploads, geometry form values, GeoJSON geometry processing, SpatialReference string input, Vary headers, and Django admin access with custom user models.
What attacker-controlled input is involved in the server-side request forgery issues?
The SSRF issues involve the crs member of GeoJSON geometries and SpatialReference string input. Applications that accept or process those inputs are relevant to triage.
Is file-upload functionality relevant to this update?
Yes. Base64-encoded file uploads handled by MultiPartParser may cause memory exhaustion, so deployments accepting multipart uploads should assess exposure.
Can restricted Django admin users be affected?
Yes. The advisory identifies potential password-hash disclosure to view-only admin users when custom user models are used.