CVE-2021-44420: Django - Bypass of Upstream Access Control
Summary
CVE-2021-44420: In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. Affects django across 3 version ranges.
>= 2.2, < 2.2.25
>= 3.1, < 3.1.14
>= 3.2, < 3.2.10
Fixed in 2.2.25, 3.1.14 or 3.2.10, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2021-44420 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a robust set of tools and features for building secure and scalable websites. However, versions 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10 of Django are vulnerable to a security issue that allows HTTP requests for URLs with trailing newlines to bypass upstream access control based on URL paths.
Vulnerability Detail
The vulnerability in Django allows attackers to bypass access control restrictions by appending newlines to the URLs. This can lead to unauthorized access to sensitive resources or actions that should be restricted. By exploiting this vulnerability, an attacker could perform actions that are otherwise restricted, potentially compromising the security and integrity of the application. It is important to note that this vulnerability only affects Django versions 2.2 to 2.2.24, 3.1 to 3.1.13, and 3.2 to 3.2.9.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.252.2.25pip install --upgrade "django==2.2.25" -
>= 3.1, < 3.1.143.1.14pip install --upgrade "django==3.1.14" -
>= 3.2, < 3.2.103.2.10pip install --upgrade "django==3.2.10"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade Django to the patched versions mentioned above to address the issue.
Conclusion
In conclusion, the CVE-2021-44420 vulnerability in Django allows for the bypass of upstream access control based on URL paths. Upgrading to the patched versions of Django is crucial to mitigate the risk of unauthorized access and ensure the security of your web application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows attackers to bypass access control restrictions, potentially leading to unauthorized access to sensitive resources or actions.
Django versions 2.2 to 2.2.24, 3.1 to 3.1.13, and 3.2 to 3.2.9 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the patched versions is the recommended solution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required, and you can simply input your Pipfile.lock to get real-time alerts for open-source vulnerabilities.
You can find more information about this vulnerability in the Django advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2021-439.yaml
Related vulnerabilities
Recent vulnerabilities recorded for django.
