shield Security update for python-django

SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1740

This update for python-Django fixes the following issues - CVE-2026-3902: headers spoofing by exploiting an ambiguous mapping of two header variants in `ASGIRequest` requests (bsc#1261729). - CVE-2026-4277: permissions on inline model instances were not validated on submission of forged POST data in GenericInlineModelAdmin (bsc#1261731). - CVE-2026-4292: admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data (bsc#1261732). - CVE-2026-5766: potential denial-of-service vulnerability in ASGI requests via file upload limit bypass (bsc#1264153). - CVE-2026-6907: potential exposure of private data due to incorrect handling of `Vary: *` in `UpdateCacheMiddleware` (bsc#1264152). - CVE-2026-33033: denial of service via missing or understated Content-Length header in ASGI requests (bsc#1261722). - CVE-2026-33034: ASGI requests with a missing or understated Content-Length header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading HttpRequest.body (bsc#1261724). - CVE-2026-35192: session fixation via public cached pages and `SESSION_SAVE_EVERY_REQUEST` (bsc#1264154).

Release Date

May 7 2026
References

Bugzilla: 1261722, 1261724, 1261729, 1261731, 1261732, 1264152, 1264153, 1264154
CVEs: CVE-2026-3902, CVE-2026-4277, CVE-2026-4292, CVE-2026-5766, CVE-2026-6907, CVE-2026-33033, CVE-2026-33034, CVE-2026-35192
Type

security
Severity

moderate

cloud_download Downloads

To download packages, you need to log in and have a valid subscription.

SUSE Package Hub 15.7 ppc64le

Packages

python-Django
A high-level Python Web framework

4.2.11-150600.3.56.1 lock src

python311-Django
A high-level Python Web framework

4.2.11-150600.3.56.1 lock rpm

SUSE Package Hub 15.7 s390x

Packages

python-Django
A high-level Python Web framework

4.2.11-150600.3.56.1 lock src

python311-Django
A high-level Python Web framework

4.2.11-150600.3.56.1 lock rpm

SUSE Package Hub 15.7 aarch64

Packages

python-Django
A high-level Python Web framework

4.2.11-150600.3.56.1 lock src

python311-Django
A high-level Python Web framework

4.2.11-150600.3.56.1 lock rpm

SUSE Package Hub 15.7 x86_64

Packages

python-Django
A high-level Python Web framework

4.2.11-150600.3.56.1 lock src

python311-Django
A high-level Python Web framework

4.2.11-150600.3.56.1 lock rpm