django Known Vulnerabilities & Fixes
django has 35 known security vulnerabilities in PyPI (Python). Upgrade to version 6.0.4 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
High Exploitation Risk
2 vulnerabilities have >50% exploit probability. Review and update soon.
Recommended safe version: 6.0.4
Upgrading to 6.0.4 or later resolves all 35 known vulnerabilities in django. Run: pip install "django>=6.0.4"
Is django in your project?
Check if you're affected and upgrade to 6.0.4 to stay secure.
Security Summary
- 125 affected version ranges have been identified across these 35 advisories.
- 100% of known issues have a published fixed version.
- Highest exploit-probability (EPSS) score for django: 92.8%.
- Remediation: pip install --upgrade django
Vulnerabilities
35 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Apr 26, 2019, most recently Apr 7, 2026 (2538 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2022-34265 Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection | CRITICAL | 3.2, 3.2.1, 3.2.10, 3.2.11 (+22 more) | 3.2.14, 4.0.6, 3.2.14 (+1 more) |
| CVE-2021-35042 SQL Injection in Django | CRITICAL | 3.2, 3.2.1, 3.2.2, 3.2.3 (+38 more) | 3.2.5, 3.1.13, 3.1.13 (+1 more) |
| CVE-2021-3281 Django Directory Traversal via archive.extract | MEDIUM | 2.2, 2.2.1, 2.2.10, 2.2.11 (+32 more) | 2.2.18, 3.1.6, 3.0.12 (+3 more) |
| CVE-2023-24580 Resource exhaustion in Django | HIGH | 3.2, 3.2.1, 3.2.10, 3.2.11 (+40 more) | 3.2.18, 4.1.7, 4.0.10 (+3 more) |
| CVE-2023-36053 Django has regular expression denial of service vulnerability in EmailValidator/URLValidator | HIGH | 3.2, 3.2.1, 3.2.10, 3.2.11 (+52 more) | 3.2.20, 4.1.10, 4.2.3 (+3 more) |
| CVE-2022-41323 Django denial-of-service vulnerability in internationalized URLs | HIGH | 3.2, 3.2.1, 3.2.10, 3.2.11 (+32 more) | 3.2.16, 4.0.8, 4.1.2 (+4 more) |
| CVE-2021-31542 Path Traversal in Django | HIGH | 2.2, 2.2.1, 2.2.10, 2.2.11 (+45 more) | 2.2.21, 3.1.9, 3.2.1 (+3 more) |
| CVE-2023-23969 Django contains Uncontrolled Resource Consumption via cached header | HIGH | 3.2, 3.2.1, 3.2.10, 3.2.11 (+37 more) | 3.2.17, 4.0.9, 4.1.6 (+3 more) |
| CVE-2022-23833 Infinite Loop in Django | HIGH | 2.2, 2.2.1, 2.2.10, 2.2.11 (+37 more) | 2.2.27, 3.2.12, 4.0.2 (+3 more) |
| CVE-2020-24583 Django Incorrect Default Permissions | HIGH | 2.2, 2.2.1, 2.2.10, 2.2.11 (+32 more) | 2.2.16, 3.0.10, 3.1.1 (+3 more) |
| CVE-2020-24584 Django Incorrect Default Permissions | MEDIUM | 2.2, 2.2.1, 2.2.10, 2.2.11 (+23 more) | 2.2.16, 3.0.10, 3.1.1 (+3 more) |
| CVE-2021-32052 Header injection possible in Django | MEDIUM | 2.2, 2.2.1, 2.2.10, 2.2.11 (+30 more) | 2.2.22, 3.1.10, 3.2.2 (+3 more) |
| CVE-2022-28346 SQL Injection in Django | CRITICAL | 2.2, 2.2.1, 2.2.10, 2.2.11 (+41 more) | 2.2.28, 3.2.13, 4.0.4 (+3 more) |
| CVE-2021-28658 Directory Traversal in Django | MEDIUM | 2.2, 2.2.1, 2.2.10, 2.2.11 (+47 more) | 2.2.20, 3.0.14, 3.1.8 (+3 more) |
| CVE-2022-28347 SQL Injection in Django | CRITICAL | 2.2, 2.2.1, 2.2.10, 2.2.11 (+41 more) | 2.2.28, 3.2.13, 4.0.4 (+3 more) |
| CVE-2022-36359 Django vulnerable to Reflected File Download attack | HIGH | 1.0.1, 1.0.2, 1.0.3, 1.0.4 (+294 more) | 3.2.15, 4.0.7, 3.2.15 (+1 more) |
| CVE-2022-22818 Cross-site Scripting in Django | MEDIUM | 2.2, 2.2.1, 2.2.10, 2.2.11 (+37 more) | 2.2.27, 3.2.12, 4.0.2 (+3 more) |
| CVE-2021-45115 Denial-of-service in Django | HIGH | 2.2, 2.2.1, 2.2.10, 2.2.11 (+43 more) | 2.2.26, 3.2.11, 4.0.1 (+3 more) |
| CVE-2021-45116 Information disclosure in Django | HIGH | 2.2, 2.2.1, 2.2.10, 2.2.11 (+34 more) | 2.2.26, 3.2.11, 4.0.1 (+3 more) |
| CVE-2021-33203 Path Traversal in Django | MEDIUM | 1.0.1, 1.0.2, 1.0.3, 1.0.4 (+262 more) | 2.2.24, 3.1.12, 3.2.4 (+3 more) |
| CVE-2021-45452 Directory-traversal in Django | MEDIUM | 2.2, 2.2.1, 2.2.10, 2.2.11 (+34 more) | 2.2.26, 3.2.11, 4.0.1 (+3 more) |
| CVE-2025-64459 Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects. | CRITICAL | 5.2, 5.2.1, 5.2.2, 5.2.3 (+404 more) | 5.2.8, 5.1.14, 4.2.26 |
| CVE-2024-45231 Django allows enumeration of user e-mail addresses | MEDIUM | 5.1, 5.0, 5.0.1, 5.0.2 (+357 more) | 5.1.1, 5.0.9, 4.2.16 |
| CVE-2025-48432 Django Improper Output Neutralization for Logs vulnerability | MEDIUM | 5.2, 5.2.1, 5.0, 5.0.1 (+386 more) | 5.2.2, 5.1.10, 4.2.22 |
| CVE-2021-44420 Potential bypass of an upstream access control based on URL paths in Django | MEDIUM | 2.2, 2.2.1, 2.2.10, 2.2.11 (+72 more) | 2.2.25, 3.1.14, 3.2.10 (+3 more) |
| CVE-2023-31047 Django bypasses validation when using one form field to upload multiple files | CRITICAL | 3.2, 3.2.1, 3.2.10, 3.2.11 (+48 more) | 3.2.19, 4.1.9, 4.2.1 (+3 more) |
| CVE-2021-33571 Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks | HIGH | 2.2, 2.2.1, 2.2.10, 2.2.11 (+63 more) | 2.2.24, 3.1.12, 3.2.4 (+3 more) |
| CVE-2025-64458 Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows | HIGH | 5.2, 5.2.1, 5.2.2, 5.2.3 (+404 more) | 5.2.8, 5.1.14, 4.2.26 |
| CVE-2025-57833 Django is subject to SQL injection through its column aliases | HIGH | 1.0.1, 1.0.2, 1.0.3, 1.0.4 (+398 more) | 4.2.24, 5.1.12, 5.2.6 |
| CVE-2026-4277 | CRITICAL | 4.2, 4.2.1, 4.2.10, 4.2.11 (+43 more) | 4.2.30, 5.2.13, 6.0.4 |
| CVE-2025-59681 | CRITICAL | 4.2, 4.2.1, 4.2.10, 4.2.11 (+41 more) | 4.2.25, 5.1.13, 5.2.7 |
| CVE-2024-53908 Django SQL injection in HasKey(lhs, rhs) on Oracle | HIGH | 5.0, 5.0.1, 5.0.2, 5.0.3 (+27 more) | 5.0.10, 5.1.4, 4.2.17 (+3 more) |
| CVE-2026-1287 Django has an SQL Injection issue | HIGH | 6.0, 6.0.1, 6.0a1, 6.0b1 (+46 more) | 6.0.2, 5.2.11, 4.2.28 |
| CVE-2026-1207 Django has an SQL Injection issue | HIGH | 6.0, 6.0.1, 6.0a1, 6.0b1 (+46 more) | 6.0.2, 5.2.11, 4.2.28 |
| CVE-2019-11358 XSS in jQuery as used in Drupal, Backdrop CMS, and other products | MEDIUM | 2.0, 2.0.1, 2.0.10, 2.0.12 (+28 more) | 2.1.9, 2.2.2 |
About This Data
Vulnerability data for django is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related PyPI (Python) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of django.