Security support for end-of-life Django
Django 4.2, the long-term support release, reached end of life on 7 April 2026. Django 3.2 and 2.2 stopped earlier. These are their last releases, with every vulnerability the US National Vulnerability Database lists for them.
Request a server assessmentDjango releases past end of life
| Django | Release | End of life | Known CVEs | Critical | Exploited | Forkward |
|---|---|---|---|---|---|---|
| 2.2.28 | Last Django 2.2 release | 11 April 2022 | 17 | 1 | 0 | Patch on order, 48 h |
| 3.2.25 | Last Django 3.2 release | 1 April 2024 | 16 | 1 | 0 | Patch on order, 48 h |
| 4.2.30 | Last Django 4.2 release | 7 April 2026 | 10 | 0 | 0 | Patch on order, 48 h |
Vulnerabilities from the OSV open-source vulnerability database, 28 October 2026, for the upstream version, counting only entries where Django itself is the vulnerable product. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Your assessment shows which of them are real on your systems.
Python
Python 2.7 and 3.6 to 3.10 are past end of life as well. Python end of life
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans