Sign in
Deutsch English Español Polski
High

Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks

  • Disclosed: 08.06.2021
  • Updated: 11.10.2026 11:20

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) django >= 2.2a1, < 2.2.24, >= 3.0a1, < 3.1.12, >= 3.2a1, < 3.2.4 2.2.24, 3.1.12, 3.2.4

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness (CWE)
CWE-918
Platform
Python (PyPI)
Package
django
Disclosed
08.06.2021
Updated
11.10.2026 11:20

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2021-99 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-p99v-5w3c-jqq9 - CC BY 4.0

Vulnerability history: django

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (162) in the archive
Total entries
162
First → latest
10.2007 08.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 16
  • High 65
  • Medium 63
  • Low 18

Disclosures per year

earlier: 56

Severity:
  1. Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
    High · 8.8 CVE-2026-15307 < 5.2.17, >= 6.0a1, < 6.0.8 5.2.17, 6.0.8
  2. Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
    High · 7.5 CVE-2026-3902 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  3. Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
    High · 7.5 CVE-2026-33034 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  4. Django vulnerable to Uncontrolled Resource Consumption
    High · 7.5 CVE-2026-25673 >= 6.0, < 6.0.3, >= 5.2, < 5.2.12, >= 4.2, < 4.2.29 6.0.3, 5.2.12, 4.2.29
  5. Django has an SQL Injection issue
    High CVE-2026-1287 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  6. Django has an SQL Injection issue
    High CVE-2026-1207 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  7. An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
    Critical · 9.1 CVE-2025-64459 >= 4.2, < 4.2.26, >= 5.1, < 5.1.14, >= 5.2, < 5.2.8 4.2.26, 5.1.14, 5.2.8
  8. Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
    High · 7.5 CVE-2025-64458 >= 5.2a1, < 5.2.8, >= 5.0a1, < 5.1.14, < 4.2.26 5.2.8, 5.1.14, 4.2.26
  9. Django vulnerable to SQL injection in column aliases
    High · 7.1 CVE-2025-59681 >= 4.2, < 4.2.25, >= 5.1, < 5.1.13, >= 5.2, < 5.2.7 4.2.25, 5.1.13, 5.2.7
  10. Django is subject to SQL injection through its column aliases
    High · 7.1 CVE-2025-57833 < 4.2.24, >= 5.0a1, < 5.1.12, >= 5.2a1, < 5.2.6 4.2.24, 5.1.12, 5.2.6
  11. Django SQL injection in HasKey(lhs, rhs) on Oracle
    High · 9.8 CVE-2024-53908 >= 5.0.0, < 5.0.10, >= 5.1.0, < 5.1.4, >= 4.2.0, < 4.2.17, >= 5.1, < 5.1.4, >= 5.0, < 5.0.10, >= 4.2, < 4.2.17 5.0.10, 5.1.4, 4.2.17
  12. An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a cr
    Critical · 9.1 CVE-2024-42005 >= 5.0, < 5.0.8, >= 4.2, < 4.2.15 5.0.8, 4.2.15
  13. Django vulnerable to Denial of Service
    High · 7.5 CVE-2024-39614 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  14. Django Path Traversal vulnerability
    High · 7.5 CVE-2024-39330 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  15. Django vulnerable to Denial of Service
    High · 7.5 CVE-2024-38875 >= 4.2, < 4.2.14, >= 5.0, < 5.0.7 4.2.14, 5.0.7
  16. Django denial-of-service attack in the intcomma template filter
    High · 5.9 CVE-2024-24680 >= 3.2, < 3.2.24, >= 4.2, < 4.2.10, >= 5.0, < 5.0.2 3.2.24, 4.2.10, 5.0.2
  17. In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of s
    High · 5.9 CVE-2023-43665 >= 3.2, < 3.2.22, >= 4.1, < 4.1.12, >= 4.2, < 4.2.6 3.2.22, 4.1.12, 4.2.6
  18. An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is su
    High · 7.5 CVE-2023-46695 >= 3.2, < 3.2.23, >= 4.1, < 4.1.13, >= 4.2, < 4.2.7 3.2.23, 4.1.13, 4.2.7
  19. In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large numb
    High · 7.5 CVE-2023-36053 >= 4.2, < 4.2.3, >= 4.0, < 4.1.10, >= 3.2, < 3.2.20 4.2.3, 4.1.10, 3.2.20
  20. In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been suppor
    Critical · 9.8 CVE-2023-31047 >= 3.2, < 3.2.19, >= 4.0, < 4.1.9, >= 4.2, < 4.2.1 3.2.19, 4.1.9, 4.2.1
  21. An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart f
    High · 7.5 CVE-2023-24580 >= 3.2, < 3.2.18, >= 4.0, < 4.0.10, >= 4.1, < 4.1.7 3.2.18, 4.0.10, 4.1.7
  22. In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-s
    High · 7.5 CVE-2023-23969 >= 3.2, < 3.2.17, >= 4.0, < 4.0.9, >= 4.1, < 4.1.6 3.2.17, 4.0.9, 4.1.6
  23. In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular
    High · 7.5 CVE-2022-41323 >= 3.2, < 3.2.16, >= 4.0, < 4.0.8, >= 4.1, < 4.1.2 3.2.16, 4.0.8, 4.1.2
  24. Django vulnerable to Reflected File Download attack
    High · 8.8 CVE-2022-36359 < 3.2.15, >= 4.0, < 4.0.7 3.2.15, 4.0.7
  25. Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
    Critical · 9.8 CVE-2022-34265 >= 3.2a1, < 3.2.14, >= 4.0a1, < 4.0.6 3.2.14, 4.0.6
  26. Django Arbitrary Code Execution
    High CVE-2007-0404 >= 0.95, < 1.0 1.0
  27. SQL Injection in Django
    Critical · 9.8 CVE-2022-28347 >= 2.2, < 2.2.28, >= 3.2, < 3.2.13, >= 4.0, < 4.0.4 2.2.28, 3.2.13, 4.0.4
  28. SQL Injection in Django
    Critical · 9.8 CVE-2022-28346 >= 2.2, < 2.2.28, >= 3.2, < 3.2.13, >= 4.0, < 4.0.4 2.2.28, 3.2.13, 4.0.4
  29. Infinite Loop in Django
    High · 7.5 CVE-2022-23833 >= 2.2, < 2.2.27, >= 3.2, < 3.2.12, >= 4.0, < 4.0.2 2.2.27, 3.2.12, 4.0.2
  30. Information disclosure in Django
    High · 7.5 CVE-2021-45116 >= 2.2, < 2.2.26, >= 3.2, < 3.2.11, >= 4.0, < 4.0.1 2.2.26, 3.2.11, 4.0.1
  31. Denial-of-service in Django
    High · 7.5 CVE-2021-45115 >= 2.2a1, < 2.2.26, >= 3.2a1, < 3.2.11, >= 4.0a1, < 4.0.1 2.2.26, 3.2.11, 4.0.1
  32. SQL Injection in Django
    Critical · 9.8 CVE-2021-35042 >= 3.2a1, < 3.2.5, >= 3.0a1, < 3.1.13 3.2.5, 3.1.13
  33. Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks this entry
    High · 7.5 CVE-2021-33571 >= 2.2a1, < 2.2.24, >= 3.0a1, < 3.1.12, >= 3.2a1, < 3.2.4 2.2.24, 3.1.12, 3.2.4
  34. Path Traversal in Django
    High · 7.5 CVE-2021-31542 >= 2.2, < 2.2.21, >= 3.0, < 3.1.9, >= 3.2, < 3.2.1 2.2.21, 3.1.9, 3.2.1
  35. Django Incorrect Default Permissions
    High · 7.5 CVE-2020-24583 >= 2.2a1, < 2.2.16, >= 3.0a1, < 3.0.10, >= 3.1a1, < 3.1.1 2.2.16, 3.0.10, 3.1.1
  36. Data leakage via cache key collision in Django
    High · 5.9 CVE-2020-13254 >= 2.2, < 2.2.13, >= 3.0, < 3.0.7 2.2.13, 3.0.7
  37. Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suit
    High · 8.8 CVE-2020-9402 >= 1.11, < 1.11.29, >= 2.2, < 2.2.11, >= 3.0, < 3.0.4 1.11.29, 2.2.11, 3.0.4
  38. SQL injection in Django
    Critical · 9.8 CVE-2020-7471 < 1.11.28, >= 2.0, < 2.2.10, >= 3.0, < 3.0.3 1.11.28, 2.2.10, 3.0.3
  39. Django Potential account hijack via password reset form
    Critical · 9.8 CVE-2019-19844 < 1.11.27, >= 2.0, < 2.2.9, >= 3.0, < 3.0.1 1.11.27, 2.2.9, 3.0.1
  40. Django allows unintended model editing
    High · 6.5 CVE-2019-19118 >= 2.1, < 2.1.15, >= 2.2, < 2.2.8 2.1.15, 2.2.8
Show more (20) Showing 40 of 81

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.