Back Linuxsecurity

Fedora 43 Advisory on Moderate Denial-of

Linuxsecurity •LinuxSecurity Advisories • October 17, 2026

Share: View original

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

Django is a high-level Python Web framework that encourages rapid

development and a clean, pragmatic design. It focuses on automating as

much as possible and adhering to the DRY (Don't Repeat Yourself)

Update Django 5 to version 5.2.18 Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in get_supported_language_variant() Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys See for more details

* Thu Oct 8 2026 Michel Lind - 5.2.18-1 - Update to version 5.2.18; Resolves: rhbz#2546600 - Fixes CVE-2026-77050 [low]: Potential denial-of-service vulnerability in get_supported_language_variant() - Fixes CVE-2026-84429 [moderate]: Potential denial-of-service vulnerability in HTTP header parsing - Fixes CVE-2026-87890 [moderate]: Potential request forgery via spatial lookup byte values - Fixes CVE-2026-87975 [moderate]: Privilege abuse in model formsets with editable primary keys

[ 1 ] Bug #2546600 - python-django5-5.2.18 is available [ 2 ] Bug #2547360 - CVE-2026-87975 python-django5: Privilege abuse in model formsets with editable primary keys [fedora-all] [ 3 ] Bug #2547365 - CVE-2026-87890 python-django5: Server-side request forgery via unvalidated bytes in spatial lookups [fedora-all] [ 4 ] Bug #2547367 - CVE-2026-84429 python-django5: Denial of service via quadratic parsing complexity in parse_header_parameters() [fedora-all] [ 5 ] Bug #2547371 - CVE-2026-77050 python-django5: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-a7b8ff851a' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs in Django 5 and 6 Lead to Denial-of-Service and Privilege Escalation Risks On October 6, 2026, several vulnerabilities were published affecting Django 5 and 6, including CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975. These vulnerabilities could allow denial-of-service attacks and privilege escalation in applications using these Django versions. Specifically, CVE-2026-77050 relates to a potential denial-of-service vulnerability in the `get_supported_language_variant()` function, while CVE-2026-87975 involves privilege abuse in model formsets. Fedora and Mageia have released updates to address these vulnerabilities, urging users to upgrade to Django 5.2.18 or Django 6.1.2. The vulnerabilities have been rated with a CVSS score of 5.3, indicating a medium severity level. As of now, there are no reports of in the wild, but users are advised to apply patches promptly to mitigate risks. 4 sources 46

Extracted Entities

Attack Types (1)

Denial-of-Service

CVEs (4)

CVE-2026-77050 CVE-2026-84429 CVE-2026-87890 CVE-2026-87975