{"id":"SUSE-SU-2026:4626-1","summary":"Security update for python-Django","details":"This update for python-Django fixes the following issues:\n\n- CVE-2026-77050: potential denial-of-service in `get_supported_language_variant()` when processing many distinct, very\n  long language codes (bsc#1284481).\n- CVE-2026-84429: potential denial-of-service attack due to quadratic time complexity when parsing a value with many\n  separators inside a quoted parameter (bsc#1284476).\n- CVE-2026-87890: An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply\n  `bytes` values to cause the Django process to make network requests via a crafted VRT document (bsc#1284472).\n- CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting queryset,\n  without any permission on the targeted object, marking an out-of-queryset object for deletion (bsc#1284471).\n","modified":"2026-10-13T10:30:05.845414717Z","published":"2026-10-12T14:57:16Z","related":["CVE-2026-77050","CVE-2026-84429","CVE-2026-87890","CVE-2026-87975"],"upstream":["CVE-2026-77050","CVE-2026-84429","CVE-2026-87890","CVE-2026-87975"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264626-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284471"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284472"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284476"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284481"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-77050"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84429"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-87890"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-87975"}],"affected":[{"package":{"name":"python-Django","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","purl":"pkg:rpm/suse/python-Django&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.68.1"}]}],"ecosystem_specific":{"binaries":[{"python311-Django":"4.2.11-150600.3.68.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4626-1.json"}}],"schema_version":"1.9.0"}