VulertSecurity VulertSecurity

Vulnerability Database · PyPI · django · Version

django 4.2.16

4.2.16 is affected by 61 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 6.1.2.

Critical 3 High 14 Medium 11 Low 8 Unrated 25

All django versions & vulnerabilities → Source repository Search the database for this package →
Released 03 Sep 2024 Licence BSD-3-Clause Also known from other sources 62 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

django 4.2.16 vulnerabilities

61 vulnerabilities cover django 4.2.16. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-4277: Django Inline Model Permissions Bypass Vulnerability 9.8 critical 4.2.30 07 Apr 2026
CVE-2025-59681: Django SQL Injection Vulnerability in QuerySet Methods 9.8 critical 4.2.25 01 Oct 2025
CVE-2025-64459: Django SQL Injection Vulnerability in QuerySet Methods 9.1 critical 4.2.26 05 Nov 2025
CVE-2026-15307: Django GeoDjango Vulnerability Allows File Writes and Outbound Requests 8.8 high 5.2.17 01 Oct 2026
CVE-2026-15307: Django GeoDjango Spatial Lookups Vulnerability Leading to File Writes and Outbound Requests 8.8 high 5.2.17 04 Aug 2026
CVE-2020-9402: Django SQL Injection Vulnerability in GIS Functions 8.8 high No fix published 05 Mar 2020
CVE-2025-57833: Django SQL Injection Vulnerability in FilteredRelation 8.1 high 4.2.24 03 Sep 2025
CVE-2026-25673: Django Uncontrolled Resource Consumption Vulnerability 7.5 high 4.2.29 13 Jul 2026
CVE-2026-3902: Django Header Spoofing Vulnerability in ASGIRequest 7.5 high 4.2.30 07 Apr 2026
CVE-2026-33034: Django Vulnerability in ASGI Request Handling Leading to Unbounded Memory Load 7.5 high 4.2.30 07 Apr 2026
CVE-2026-1285: Django Denial-of-Service via HTML Tag Handling 7.5 high 4.2.28 03 Feb 2026
CVE-2025-14550: Django ASGIRequest Denial-of-Service Vulnerability 7.5 high 4.2.28 03 Feb 2026
CVE-2025-64460: Django XML Deserializer Denial-of-Service Vulnerability 7.5 high 4.2.27 02 Dec 2025
CVE-2025-64458: Django Denial-of-Service Vulnerability Due to Slow NFKC Normalization on Windows 7.5 high 4.2.26 05 Nov 2025
CVE-2011-4140: Django CSRF Protection Bypass 7.5 high No fix published 23 Jul 2018
CVE-2025-59681: Django SQL Injection Vulnerability in Column Aliases 7.1 high 4.2.25 01 Oct 2025
CVE-2025-57833: Django SQL Injection Vulnerability in Column Aliases 7.1 high 4.2.24 08 Sep 2025
CVE-2026-33033: Django MultipartParser Excessive Whitespace Vulnerability 6.5 medium 4.2.30 07 Apr 2026
CVE-2026-53878: Django DomainNameValidator Allows Newline Characters Leading to HTTP Header Injection 6.1 medium 5.2.16 07 Jul 2026
CVE-2026-1312: Django SQL Injection Vulnerability in QuerySet.order_by() 5.4 medium 4.2.28 03 Feb 2026
CVE-2026-1207: Django SQL Injection Vulnerability in RasterField 5.4 medium 4.2.28 03 Feb 2026
CVE-2026-1287: Django SQL Injection Vulnerability in FilteredRelation 5.4 medium 4.2.28 03 Feb 2026
CVE-2026-15830: Django Denial of Service Vulnerability in GeoDjango due to Deeply Nested Geometry Collections 5.3 medium 5.2.17 04 Aug 2026
CVE-2025-13473: Django User Enumeration via Timing Attack in Authentication 5.3 medium 4.2.28 03 Feb 2026
CVE-2025-32873: Django Denial-of-Service Vulnerability in strip_tags() Function 5.3 medium 4.2.21 08 May 2025
CVE-2025-26699: Django Denial-of-Service Vulnerability Due to Resource Allocation Issues 5.0 medium 4.2.20 06 Mar 2025
CVE-2026-53877: Django GDALRaster Heap Memory Over-Read Vulnerability 4.8 medium 5.2.16 07 Jul 2026
CVE-2025-13372: Django SQL Injection Vulnerability in FilteredRelation 4.3 medium 4.2.27 02 Dec 2025
CVE-2026-25674: Django Race Condition Vulnerability in File System Storage 3.7 low 4.2.29 13 Jul 2026
CVE-2025-59682: Django Partial Directory Traversal Vulnerability 3.1 low 4.2.25 07 Jul 2026
CVE-2026-48588: Django Cache Middleware Vulnerability Exposing Private Responses 3.1 low 5.2.16 07 Jul 2026
CVE-2026-48587: Django Vary Header Whitespace Vulnerability Exposes Cached Responses 3.1 low 5.2.15 03 Jun 2026
CVE-2026-8404: Django Cache-Control Case Sensitivity Vulnerability 3.1 low 5.2.15 03 Jun 2026
CVE-2026-6873: Django Signed Cookies Vulnerable to Salt Namespace Collisions 3.1 low 5.2.15 03 Jun 2026
CVE-2025-59682: Django Vulnerable to Partial Directory Traversal via Archives 3.1 low 4.2.25 01 Oct 2025
CVE-2026-4292: Django Vulnerability Allows Forged POST Data to Create New Instances 2.7 low 4.2.30 07 Apr 2026
CVE-2026-15830: Django Denial-of-Service Vulnerability in GeoDjango's GEOSGeometry N/A unrated 5.2.17 04 Aug 2026
CVE-2026-33034: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-3902: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-25673: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-1207: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-1287: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2025-64459: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-64458: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-59681: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-57833: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-48432: Django HTTP Response Logging Vulnerability Leading to Log Injection N/A unrated 5.2.2 05 Jun 2025
CVE-2025-32873: Django Denial-of-Service Vulnerability in strip_tags Function N/A unrated 4.2.21 08 May 2025
CVE-2025-26699: Django Denial-of-Service Vulnerability in Text Wrapping Functions N/A unrated 5.1.7 06 Mar 2025
CVE-2024-56374: Django IPv6 Validation Denial-of-Service Vulnerability N/A unrated 5.1.5 14 Jan 2025
CVE-2024-53908: Django SQL Injection Vulnerability in JSON Field Lookup N/A unrated 5.1.4 06 Dec 2024
CVE-2024-53907: Django Denial-of-Service Vulnerability via strip_tags() Method N/A unrated 5.1.4 06 Dec 2024
CVE-2022-41323: Django - Denial of Service via Locale Parameter N/A unrated 5b6b257fa7ec37ff27965358800c67e2dd11c924 16 Oct 2022
CVE-2016-2513: Django Password Hasher Timing Attack N/A unrated 67b46ba7016da2d259c1ecc7d666d11f5e1cfaab 08 Apr 2016
CVE-2015-8213: Django - Sensitive Application Secrets Disclosure N/A unrated 316bc3fc9437c5960c24baceb93c73f1939711e4 07 Dec 2015
CVE-2013-4249: Cross-Site Scripting (XSS) Vulnerability in Django N/A unrated 90363e388c61874add3f3557ee654a996ec75d78 04 Oct 2013
CVE-2012-4520: Django Arbitrary URL Generation Vulnerability N/A unrated 9305c0e12d43c4df999c3301a1f0c742264a657e 18 Nov 2012
CVE-2011-0697: Django Cross-Site Scripting Vulnerability in File Uploads N/A unrated No fix published 14 Feb 2011
CVE-2011-0696: Django Cross-Site Request Forgery Vulnerability in AJAX Requests N/A unrated No fix published 14 Feb 2011
CVE-2010-4535: Django Password Reset Functionality Denial of Service Vulnerability N/A unrated No fix published 10 Jan 2011
CVE-2010-4534: Django Administrative Interface Query String Vulnerability N/A unrated No fix published 10 Jan 2011

Looking for another version, or everything Vulert holds for django?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About django 4.2.16

Is django 4.2.16 vulnerable?

Yes. 61 vulnerabilities in the Vulert database cover django 4.2.16: 3 critical, 14 high, 11 medium and 8 low, plus 25 not yet rated. The upgrade Vulert recommends is 6.1.2, and each entry above names the fixed version to move to.

Which version of django should I use instead of 4.2.16?

6.1.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 4.2.16 the latest release of django?

No. 4.2.16 was published 03 Sep 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor django for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the django version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.