SB2026101311 - SUSE update for python-Django
Published: October 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-77050)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to insufficient limits on memory consumption in django.utils.translation.get_supported_language_variant() when processing language codes that are cached before their length is limited. A remote attacker can supply many distinct, very long language codes to cause a denial of service.
2) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-84429)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to quadratic time complexity in django.utils.http.parse_header_parameters() when parsing header values containing many separators inside a quoted parameter. A remote attacker can send a specially crafted request containing such values in Accept or Content-Type headers to cause a denial of service.
Unauthenticated requests can reach the parser through content negotiation performed by HttpRequest.accepts(). The per-call length limit does not bound the combined size of repeated headers.
3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-87890)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to induce server-side network requests.
The vulnerability exists due to acceptance of raster byte values without explicit GDALRaster wrapping in Django spatial lookups when preparing lookups from attacker-controlled bytes. A remote attacker can supply a VRT document referencing an external raster source to induce server-side network requests.
Exploitation requires an application to pass attacker-controlled bytes directly to a spatial lookup. GDAL opens these values through its in-memory virtual filesystem, and the resulting requests run as the Django process user.
4) Incorrect authorization (CVE-ID: CVE-2026-87975)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to delete instances outside the limiting queryset or create instances through edit-only formsets.
The vulnerability exists due to improper authorization enforcement in Django model formsets when processing submitted data for models whose primary keys can be set through the form. A remote attacker can submit forged POST data to delete instances outside the limiting queryset or create instances through edit-only formsets.
Affected configurations include a OneToOneField or parent link used as the primary key of an inline formset's model, or a natural or UUID primary key included in the form's fields. Models using the default BigAutoField primary key are not affected.
5) Input validation error (CVE-ID: CVE-2026-15307)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to write files to disk or issue network requests as the Django process user.
The vulnerability exists due to improper input validation in spatial lookups when processing lookup values that are passed to GDALRaster. A remote user can supply a specially crafted lookup value to write files to disk or issue network requests as the Django process user.
The issue was reachable through the admin changelist for staff users with view permissions on any registered model containing a spatial field.
Remediation
Install update from vendor's website.