Django 3.2, end of life since 1 April 2024
Django 3.2.25 vulnerabilities
Django 3.2.25 is the last release of the 3.2 branch, end of life since 1 April 2024. The OSV open-source vulnerability database lists 16 vulnerabilities for this version, 1 of them critical. The Django project fixes flaws only in supported releases.
- 16known vulnerabilities
- 1critical
- 4high
- 0exploited in the wild
What you can do
Keep Django 3.2.25, patched
We backport the security fixes to the Django release your application runs, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported Django release once your application can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.
All 16 known vulnerabilities in Django 3.2.25
OSV.dev, the open-source vulnerability database used by GitHub and Google, 28 October 2026, highest score first. Fixed in: the first upstream release with the fix, where OSV records it. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.
| CVE | Score | Severity | Published | Fixed in | Description |
|---|---|---|---|---|---|
| CVE-2025-64459 | 9.1 | Critical | 2025-11-05 | 4.2.26 | Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects. |
| CVE-2026-15307 | 8.8 | High | 2026-08-04 | 5.2.17 | Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing |
| CVE-2026-15307 | 8.8 | High | 2026-10-01 | 5.2.17 | Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing |
| CVE-2025-64458 | 7.5 | High | 2025-11-05 | 4.2.26 | Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows |
| CVE-2025-57833 | 7.1 | High | 2025-09-08 | 4.2.24 | Django is subject to SQL injection through its column aliases |
| CVE-2026-53878 | 6.1 | Medium | 2026-07-07 | 5.2.16 | Django: DomainNameValidator permits newline characters that may enable HTTP header injection |
| CVE-2026-15830 | 5.3 | Medium | 2026-08-04 | 5.2.17 | Django GeoDjango vulnerable to denial of service through deeply nested geometry collections |
| CVE-2026-53877 | 4.8 | Medium | 2026-07-07 | 5.2.16 | Django: GDALRaster may over-read heap memory when constructed from bytes |
| CVE-2025-48432 | 4.0 | Medium | 2025-06-05 | 4.2.22 | Django Improper Output Neutralization for Logs vulnerability |
| CVE-2024-45231 | 3.7 | Low | 2024-10-08 | 4.2.16 | Django allows enumeration of user e-mail addresses |
| CVE-2024-45231 | 3.7 | Low | 2026-07-07 | 4.2.16 | Django allows enumeration of user e-mail addresses |
| CVE-2026-48587 | 3.1 | Low | 2026-06-03 | 5.2.15 | Django: has_vary_header may expose cached responses when Vary values contain whitespace |
| CVE-2026-48588 | 3.1 | Low | 2026-07-07 | 5.2.16 | Django: cache middleware may expose private responses when unrelated request cookies are present |
| CVE-2026-6873 | 3.1 | Low | 2026-06-03 | 5.2.15 | Django: signed cookies are vulnerable to salt namespace collisions |
| CVE-2026-8404 | 3.1 | Low | 2026-06-03 | 5.2.15 | Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling |
| CVE-2026-15830 | n/a | N/a | 2026-08-04 | 5.2.17 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue. |