Skip to content
Multiple CVEs in Django 5 and 6 Lead to Denial-of-Service and Privilege Escalation Risks

Multiple CVEs in Django 5 and 6 Lead to Denial-of-Service and Privilege Escalation Risks

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 20:48 UTC

On October 6, 2026, several vulnerabilities were published affecting Django 5 and 6, including CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975. These vulnerabilities could allow denial-of-service attacks and privilege escalation in applications using these Django versions. Specifically, CVE-2026-77050 relates to a potential denial-of-service vulnerability in the `get_supported_language_variant()` function, while CVE-2026-87975 involves privilege abuse in model formsets. Fedora and Mageia have released updates to address these vulnerabilities, urging users to upgrade to Django 5.2.18 or Django 6.1.2. The vulnerabilities have been rated with a CVSS score of 5.3, indicating a medium severity level. As of now, there are no reports of in the wild, but users are advised to apply patches promptly to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-06
CVE vulnerabilities published
Multiple vulnerabilities affecting Django 5 and 6 were published, including CVE-2026-77050 and CVE-2026-87975.
Linuxsecurity
2026-10-06
CVE-2026-87890 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-06
CVE-2026-84429 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-06
CVE-2026-77050 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-06
CVE-2026-87975 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-17
Patches released for Django
Fedora and Mageia released updates for Django 5.2.18 and Django 6.1.2 to address the vulnerabilities.
Linuxsecurity

More articles in this cluster (4)

Following this threat?

Track Fedora and CVE-2026-77050 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 3

Common questions

Which versions of Django are affected?
Django 5.2.18 and earlier versions, as well as Django 6.1.2 and earlier versions.
Are these vulnerabilities being exploited?
Currently, there are no reports of active exploitation in the wild.
What should I do to protect my systems?
Upgrade to Django 5.2.18 or Django 6.1.2 immediately to mitigate the risks associated with these vulnerabilities.