Django patches six flaws, including a cache mix-up that can expose data

Django patches six flaws, including a cache mix-up that can expose data

3 November 2026: The Django project has released 6.1.3, 6.0.10 and 5.2.19 to fix six security issues, the most serious a moderate server-side request forgery, CVE-2026-111362, in how GeoJSON geometries are handled. Django rates the other five low, but one of them can show one user's cached private data to another, which is the fix most sites will want to look at first.

The cache flaw is the one for ordinary sites

CVE-2026-113593 is a key confusion between empty and missing Vary headers, and it affects sites using cache_page or UpdateCacheMiddleware. Under the wrong conditions a response meant for one user could be served to another. No GIS or unusual setup is needed, so it applies to many more sites than the headline flaw does, despite its low rating.

The fix has a visible side effect. Responses previously cached for requests that omitted a Vary header will not match any more and are cached again, so a busy site may see a short rise in cache misses and origin load just after the upgrade. It is worth planning the deployment outside peak traffic for that reason.

GIS users have the most to do

Three of the six affect GeoDjango or its forms:

• CVE-2026-111362 (moderate): server-side request forgery through the crs member of GeoJSON geometries
• CVE-2026-114582 (low): server-side request forgery through SpatialReference string input
• CVE-2026-111211 (low): log injection from GIS form values

The SpatialReference fix comes with a condition. Full protection needs GDAL 3.9 or later, and Django has added a system check, gis.W001, that warns about it. A project that upgrades Django and leaves GDAL behind would remain partly exposed, and base images often pin an older GDAL, so the check's output should be read in each environment rather than assumed clean.

Admin views and uploads

CVE-2026-113733 shows a password hash to view-only admin users on projects with custom user models. It is fixed on main, 6.1 and 6.0 only, so 5.2 is not listed for that one. A project with outside contractors or support staff holding view-only admin access should check who has been able to see those fields, and consider whether a reset is warranted.

CVE-2026-108147 is memory exhaustion in MultiPartParser on base64 uploads. Rated low, it is still a way to tie up workers on any public form that accepts files, and an upload size limit at the proxy reduces the exposure until the patch is in.

Django's release post was written by Jacob Walls, and the severity ratings are the project's own. Teams on versions outside these three lines should note that the post lists fixes only for those lines, so an older project has an upgrade to plan as well as a patch to apply.

Sources

• Django: Security releases issued, 6.1.3, 6.0.10 and 5.2.19, 3 November 2026, 3 November 2026