VulertSecurity VulertSecurity

Vulnerability Database · PyPI · django · Version

django 5.0.9

5.0.9 is affected by 36 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 6.1.2.

Critical 0 High 5 Medium 4 Low 4 Unrated 23

All django versions & vulnerabilities → Source repository Search the database for this package →
Released 03 Sep 2024 Licence BSD-3-Clause Also known from other sources 24 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

django 5.0.9 vulnerabilities

36 vulnerabilities cover django 5.0.9. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2024-53908: Django SQL Injection Vulnerability in HasKey Lookup on Oracle 9.8 high 5.0.10 06 Dec 2024
CVE-2026-15307: Django GeoDjango Vulnerability Allows File Writes and Outbound Requests 8.8 high 5.2.17 01 Oct 2026
CVE-2026-15307: Django GeoDjango Spatial Lookups Vulnerability Leading to File Writes and Outbound Requests 8.8 high 5.2.17 04 Aug 2026
CVE-2020-9402: Django SQL Injection Vulnerability in GIS Functions 8.8 high No fix published 05 Mar 2020
CVE-2011-4140: Django CSRF Protection Bypass 7.5 high No fix published 23 Jul 2018
CVE-2026-53878: Django DomainNameValidator Allows Newline Characters Leading to HTTP Header Injection 6.1 medium 5.2.16 07 Jul 2026
CVE-2025-27556: Django Denial of Service Vulnerability on Windows Systems 5.8 medium 5.0.14 02 Apr 2025
CVE-2026-15830: Django Denial of Service Vulnerability in GeoDjango due to Deeply Nested Geometry Collections 5.3 medium 5.2.17 04 Aug 2026
CVE-2026-53877: Django GDALRaster Heap Memory Over-Read Vulnerability 4.8 medium 5.2.16 07 Jul 2026
CVE-2026-48588: Django Cache Middleware Vulnerability Exposing Private Responses 3.1 low 5.2.16 07 Jul 2026
CVE-2026-6873: Django Signed Cookies Vulnerable to Salt Namespace Collisions 3.1 low 5.2.15 03 Jun 2026
CVE-2026-48587: Django Vary Header Whitespace Vulnerability Exposes Cached Responses 3.1 low 5.2.15 03 Jun 2026
CVE-2026-8404: Django Cache-Control Case Sensitivity Vulnerability 3.1 low 5.2.15 03 Jun 2026
CVE-2026-15830: Django Denial-of-Service Vulnerability in GeoDjango's GEOSGeometry N/A unrated 5.2.17 04 Aug 2026
CVE-2026-33034: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-3902: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-25673: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-1207: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-1287: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2025-64459: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-64458: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-59681: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-57833: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-27556: Django Denial-of-Service Vulnerability Due to Slow NFKC Normalization N/A unrated 5.1.8 02 Apr 2025
CVE-2025-26699: Django Denial-of-Service Vulnerability in Text Wrapping Functions N/A unrated 5.1.7 06 Mar 2025
CVE-2024-56374: Django IPv6 Validation Denial-of-Service Vulnerability N/A unrated 5.1.5 14 Jan 2025
CVE-2024-53908: Django SQL Injection Vulnerability in JSON Field Lookup N/A unrated 5.1.4 06 Dec 2024
CVE-2024-53907: Django Denial-of-Service Vulnerability via strip_tags() Method N/A unrated 5.1.4 06 Dec 2024
CVE-2016-2513: Django Password Hasher Timing Attack N/A unrated 67b46ba7016da2d259c1ecc7d666d11f5e1cfaab 08 Apr 2016
CVE-2015-8213: Django - Sensitive Application Secrets Disclosure N/A unrated 316bc3fc9437c5960c24baceb93c73f1939711e4 07 Dec 2015
CVE-2013-4249: Cross-Site Scripting (XSS) Vulnerability in Django N/A unrated 90363e388c61874add3f3557ee654a996ec75d78 04 Oct 2013
CVE-2012-4520: Django Arbitrary URL Generation Vulnerability N/A unrated 9305c0e12d43c4df999c3301a1f0c742264a657e 18 Nov 2012
CVE-2011-0696: Django Cross-Site Request Forgery Vulnerability in AJAX Requests N/A unrated No fix published 14 Feb 2011
CVE-2011-0697: Django Cross-Site Scripting Vulnerability in File Uploads N/A unrated No fix published 14 Feb 2011
CVE-2010-4535: Django Password Reset Functionality Denial of Service Vulnerability N/A unrated No fix published 10 Jan 2011
CVE-2010-4534: Django Administrative Interface Query String Vulnerability N/A unrated No fix published 10 Jan 2011

Looking for another version, or everything Vulert holds for django?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About django 5.0.9

Is django 5.0.9 vulnerable?

Yes. 36 vulnerabilities in the Vulert database cover django 5.0.9: 0 critical, 5 high, 4 medium and 4 low, plus 23 not yet rated. The upgrade Vulert recommends is 6.1.2, and each entry above names the fixed version to move to.

Which version of django should I use instead of 5.0.9?

6.1.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 5.0.9 the latest release of django?

No. 5.0.9 was published 03 Sep 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor django for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the django version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.