VulertSecurity VulertSecurity

Vulnerability Database · PyPI · django · Version

django 5.2.0rc1

5.2.0rc1 is affected by 47 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 6.1.2.

Critical 1 High 5 Medium 12 Low 5 Unrated 24

All django versions & vulnerabilities → Source repository Search the database for this package →
Released 19 Mar 2025 Licence BSD-3-Clause Also known from other sources 21 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

django 5.2.0rc1 vulnerabilities

47 vulnerabilities cover django 5.2.0rc1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2025-64459: Django SQL Injection Vulnerability via _connector Keyword Argument 9.1 critical 5.2.8 05 Nov 2025
CVE-2026-15307: Django GeoDjango Vulnerability Allows File Writes and Outbound Requests 8.8 high 5.2.17 01 Oct 2026
CVE-2026-15307: Django GeoDjango Spatial Lookups Vulnerability Leading to File Writes and Outbound Requests 8.8 high 5.2.17 04 Aug 2026
CVE-2020-9402: Django SQL Injection Vulnerability in GIS Functions 8.8 high No fix published 05 Mar 2020
CVE-2025-64458: Django Denial-of-Service Vulnerability in HttpResponseRedirect on Windows 7.5 high 5.2.8 05 Nov 2025
CVE-2011-4140: Django CSRF Protection Bypass 7.5 high No fix published 23 Jul 2018
CVE-2026-35192: Django Session Cookie Exposure Vulnerability 6.5 medium 5.2.14 05 May 2026
CVE-2025-64460: Django Denial-of-Service Vulnerability via XML Serializer 6.3 medium 5.2.9 02 Dec 2025
CVE-2026-53878: Django DomainNameValidator Allows Newline Characters Leading to HTTP Header Injection 6.1 medium 5.2.16 07 Jul 2026
CVE-2026-15830: Django Denial of Service Vulnerability in GeoDjango due to Deeply Nested Geometry Collections 5.3 medium 5.2.17 04 Aug 2026
CVE-2026-48588: Django Cache Vulnerability Allows Unauthorized Data Access 5.3 medium 5.2.16 07 Jul 2026
CVE-2026-8404: Django Cache-Control Case Sensitivity Vulnerability 5.3 medium 5.2.15 03 Jun 2026
CVE-2026-48587: Django Vary Header Whitespace Vulnerability 5.3 medium 5.2.15 03 Jun 2026
CVE-2026-6907: Django Cache Middleware Vulnerability Leading to Private Data Exposure 5.3 medium 5.2.14 05 May 2026
CVE-2026-53877: Django GDALRaster Heap Memory Over-Read Vulnerability 4.8 medium 5.2.16 07 Jul 2026
CVE-2026-6873: Django Cookie Signing Vulnerability Due to Non-injective Salt Derivation 4.3 medium 5.2.15 03 Jun 2026
CVE-2025-13372: Django SQL Injection Vulnerability in Column Aliases 4.3 medium 5.2.9 02 Dec 2025
CVE-2025-48432: Django Improper Output Neutralization for Logs Vulnerability 4.0 medium 5.2.2 05 Jun 2025
CVE-2026-48588: Django Cache Middleware Vulnerability Exposing Private Responses 3.1 low 5.2.16 07 Jul 2026
CVE-2026-7666: Django Email Backend Vulnerability Allows Cleartext Email Interception 3.1 low 5.2.15 03 Jun 2026
CVE-2026-6873: Django Signed Cookies Vulnerable to Salt Namespace Collisions 3.1 low 5.2.15 03 Jun 2026
CVE-2026-8404: Django Cache-Control Case Sensitivity Vulnerability 3.1 low 5.2.15 03 Jun 2026
CVE-2026-48587: Django Vary Header Whitespace Vulnerability Exposes Cached Responses 3.1 low 5.2.15 03 Jun 2026
CVE-2026-15830: Django Denial-of-Service Vulnerability in GeoDjango's GEOSGeometry N/A unrated 5.2.17 04 Aug 2026
CVE-2026-53877: Django Memory Over-read Vulnerability in GDALRaster N/A unrated 5.2.16 07 Jul 2026
CVE-2026-53878: Django DomainNameValidator Newline Injection Vulnerability N/A unrated 5.2.16 07 Jul 2026
CVE-2026-7666: Django Email Backend Vulnerability Allows Cleartext Email Interception N/A unrated 5.2.15 03 Jun 2026
CVE-2026-35193: Django Cache Middleware Vulnerability Allows Unauthorized Access to Private Responses N/A unrated 5.2.15 03 Jun 2026
CVE-2026-5766: Django File Upload Memory Limit Bypass Vulnerability N/A unrated 5.2.14 05 May 2026
CVE-2026-33034: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-3902: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-25673: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-1207: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2026-1287: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 20 Apr 2026
CVE-2025-64459: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-64458: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-59681: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-57833: Django Package Vulnerability Leading to Potential Security Risks N/A unrated 5.2.1+echo.1 25 Nov 2025
CVE-2025-48432: Django HTTP Response Logging Vulnerability Leading to Log Injection N/A unrated 5.2.2 05 Jun 2025
CVE-2016-2513: Django Password Hasher Timing Attack N/A unrated 67b46ba7016da2d259c1ecc7d666d11f5e1cfaab 08 Apr 2016
CVE-2015-8213: Django - Sensitive Application Secrets Disclosure N/A unrated 316bc3fc9437c5960c24baceb93c73f1939711e4 07 Dec 2015
CVE-2013-4249: Cross-Site Scripting (XSS) Vulnerability in Django N/A unrated 90363e388c61874add3f3557ee654a996ec75d78 04 Oct 2013
CVE-2012-4520: Django Arbitrary URL Generation Vulnerability N/A unrated 9305c0e12d43c4df999c3301a1f0c742264a657e 18 Nov 2012
CVE-2011-0697: Django Cross-Site Scripting Vulnerability in File Uploads N/A unrated No fix published 14 Feb 2011
CVE-2011-0696: Django Cross-Site Request Forgery Vulnerability in AJAX Requests N/A unrated No fix published 14 Feb 2011
CVE-2010-4535: Django Password Reset Functionality Denial of Service Vulnerability N/A unrated No fix published 10 Jan 2011
CVE-2010-4534: Django Administrative Interface Query String Vulnerability N/A unrated No fix published 10 Jan 2011

Looking for another version, or everything Vulert holds for django?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About django 5.2.0rc1

Is django 5.2.0rc1 vulnerable?

Yes. 47 vulnerabilities in the Vulert database cover django 5.2.0rc1: 1 critical, 5 high, 12 medium and 5 low, plus 24 not yet rated. The upgrade Vulert recommends is 6.1.2, and each entry above names the fixed version to move to.

Which version of django should I use instead of 5.2.0rc1?

6.1.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 5.2.0rc1 the latest release of django?

No. 5.2.0rc1 was published 19 Mar 2025, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor django for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the django version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.