CVE-2021-44420: Potential bypass of upstream access control in Django
Summary
CVE-2021-44420: Potential bypass of an upstream access control based on URL paths in Django. Affects django across 3 version ranges.
>= 2.2a1, < 2.2.25
>= 3.0a1, < 3.1.14
>= 3.2a1, < 3.2.10
Fixed in 2.2.25, 3.1.14 or 3.2.10, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2021-44420 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building web applications. It provides a robust set of tools and features for efficient development. However, Django versions 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10 are vulnerable to a potential bypass of upstream access control based on URL paths. This vulnerability allows HTTP requests with trailing newlines to bypass access control mechanisms. The severity of this vulnerability is rated as HIGH.
Vulnerability Detail
The vulnerability in Django allows attackers to bypass access control based on URL paths. By appending trailing newlines to URLs, attackers can evade the intended access restrictions and gain unauthorized access to protected resources. This issue has been identified as a low severity vulnerability according to the Django security policy. However, it is still important to address this vulnerability to prevent potential unauthorized access and protect sensitive data.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2a1, < 2.2.252.2.25pip install --upgrade "django==2.2.25" -
>= 3.0a1, < 3.1.143.1.14pip install --upgrade "django==3.1.14" -
>= 3.2a1, < 3.2.103.2.10pip install --upgrade "django==3.2.10"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by upgrading Django to the fixed versions.
Conclusion
The vulnerability in Django versions 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10 allows for potential bypass of upstream access control based on URL paths. It is recommended to upgrade Django to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows attackers to bypass access control and potentially gain unauthorized access to protected resources.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the CVSS score for this vulnerability is 7.3.
There are no known exploits for this vulnerability at the moment.
You can refer to the GitHub advisory database for detailed information about this vulnerability. The link to the advisory is provided in the 'database_specific' field of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for django.
