https://seclists.org/oss-sec/2026/q4/59: Django CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975
Published Oct 6, 2026
·Updated
Affected Software
1 affected component
pypi/django<6.1.2, <6.0.9, <5.2.18
Frequently Asked Questions
1
Which Django releases include fixes for the reported security issues?
The Django team issued Django 6.1.2, 6.0.9, and 5.2.18 to address these issues. Users are encouraged to upgrade as soon as possible.
2
What conditions are needed to trigger the denial-of-service issue in get_supported_language_variant()?
The issue can be triggered when django.utils.translation.get_supported_language_variant() processes many distinct, very long language codes. Exposure therefore depends on whether an attacker can cause the application to process such language-code input.