Back Linuxsecurity

Fedora 42 python-django5 Critical SQL Injection DoS Fixes 2026

Linuxsecurity •LinuxSecurity Advisories • February 28, 2026

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY (Don't Repeat Yourself) principle. Update Information : Fixes CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler Fixes CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI Fixes CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS Fixes CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods Fixes CVE-2026-1287: Potential SQL injection in column aliases via control characters Fixes CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation Fixed a bug in Django 5.2 where data exceeding max_length was silently truncated by QuerySet.bulk_create() on PostgreSQL Fixed a bug where management command colorized help (introduced in Python 3.14) ignored the --no-color option and the DJANGO_COLORS setting

Django is a high-level Python Web framework that encourages rapid

development and a clean, pragmatic design. It focuses on automating as

much as possible and adhering to the DRY (Don't Repeat Yourself)

Fixes CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler Fixes CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI Fixes CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS Fixes CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods Fixes CVE-2026-1287: Potential SQL injection in column aliases via control characters Fixes CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation Fixed a bug in Django 5.2 where data exceeding max_length was silently truncated by QuerySet.bulk_create() on PostgreSQL Fixed a bug where management command colorized help (introduced in Python 3.14) ignored the --no-color option and the DJANGO_COLORS setting

* Thu Feb 19 2026 Michel Lind - 5.2.11-1 - Update to version 5.2.11; Resolves: RHBZ#2427483 - `python-django5` is now the alternate `python3-django5` on Fedora 44+, `python3-django` is now Django 6.x - Fixes CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler - Fixes CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI - Fixes CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS - Fixes CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods - Fixes CVE-2026-1287: Potential SQL injection in column aliases via control characters - Fixes CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation - Fixed a bug in Django 5.2 where data exceeding max_length was silently truncated by QuerySet.bulk_create() on PostgreSQL - Fixed a bug where management command colorized help (introduced ...

[ 1 ] Bug #2427483 - python-django5-5.2.11 is available [ 2 ] Bug #2436695 - CVE-2025-14550 python-django5: Django: Denial of Service via crafted request with duplicate headers [fedora-42] [ 3 ] Bug #2436699 - CVE-2026-1312 python-django5: Django: SQL injection via crafted column aliases in QuerySet.order_by() [fedora-42] [ 4 ] Bug #2436709 - CVE-2026-1285 python-django5: Django: Denial of Service via crafted HTML inputs [fedora-42] [ 5 ] Bug #2436714 - CVE-2026-1287 python-django5: Django: SQL Injection via crafted column aliases [fedora-42] [ 6 ] Bug #2436716 - CVE-2026-1207 python-django5: Django: SQL Injection via RasterField band index parameter [fedora-42] ... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-00b5bf3150' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Django Framework Security Fixes Released Fedora has released critical security updates for the Django framework addressing multiple vulnerabilities. The updates include fixes for CVE-2025-13473, CVE-2025-14550, and CVE-2026-1207, which involve issues such as username enumeration and potential denial-of-service attacks. Affected users are encouraged to update to the latest versions to mitigate these risks. 3 sources 41

Extracted Entities

Fedora 42 python-django5 Critical SQL Injection DoS Fixes 2026

The full story

Extracted Entities

Attack Types (2)

Companies (1)

CVEs (6)

Platforms (4)

Tools (1)