CVE-2020-13254: Django - Key Collision and Data Leakage
Summary
CVE-2020-13254: An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Affects django across 2 version ranges.
>= 2.2, < 2.2.13
>= 3.0, < 3.0.7
Fixed in 2.2.13 or 3.0.7, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2020-13254 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a high-level API for handling web requests, managing databases, and rendering HTML templates. Django utilizes various backends for caching, including memcached. Memcached is a distributed memory object caching system that stores data in key-value pairs. However, prior to versions 2.2.13 and 3.0.7, Django's memcached backend did not perform key validation, which could lead to key collisions and potential data leakage.
Vulnerability Detail
The vulnerability (CVE-2020-13254) in Django arises when a memcached backend fails to validate cache keys. By passing malformed cache keys, an attacker can trigger a key collision, potentially resulting in the leakage of sensitive data. This occurs because the backend does not properly handle collisions and may return data associated with a different key. The impact of this vulnerability depends on the nature of the data stored in the cache and the privileges of the attacker.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.132.2.13pip install --upgrade "django==2.2.13" -
>= 3.0, < 3.0.73.0.7pip install --upgrade "django==3.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to manually validate cache keys before passing them to the memcached backend. This can be achieved by implementing a custom cache key validation function that ensures the keys are properly formatted and do not contain any potentially malicious characters. Here is an example of a custom cache key validation function in Python:
import re
def validate_cache_key(key):
# Regular expression pattern to match valid cache keys
pattern = r'^[a-zA-Z0-9_]+$'
if re.match(pattern, key):
return True
else:
return False
Conclusion
In conclusion, the vulnerability (CVE-2020-13254) in Django's memcached backend can lead to key collisions and potential data leakage. It is crucial to upgrade Django to version 2.2.13 or 3.0.7, or any subsequent secure release, to mitigate this risk. If immediate upgrading is not possible, implementing a custom cache key validation function can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The impact of this vulnerability depends on the data stored in the cache and the privileges of the attacker. If sensitive information is cached and an attacker can trigger key collisions, they may be able to access and retrieve data associated with different keys, potentially leading to data leakage.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file of your application.
No, only Django versions prior to 2.2.13 and 3.0.7 are affected by this vulnerability. It is recommended to upgrade to a secure release to mitigate the risk.
Yes, the vulnerability can be fixed by upgrading Django to version 2.2.13 or 3.0.7, or any subsequent secure release. These versions include the necessary key validation to prevent collisions and data leakage.
While upgrading Django is the recommended solution, you can also implement a custom cache key validation function to manually validate cache keys before passing them to the memcached backend. This can provide an additional layer of security until the upgrade is performed.
Related vulnerabilities
Recent vulnerabilities recorded for django.
