Django 4.2, end of life since 7 April 2026
Django 4.2.30 vulnerabilities
Django 4.2.30 is the last release of the 4.2 branch, end of life since 7 April 2026. The OSV open-source vulnerability database lists 10 vulnerabilities for this version, none of them critical. The Django project fixes flaws only in supported releases.
- 10known vulnerabilities
- 0critical
- 2high
- 0exploited in the wild
What you can do
Keep Django 4.2.30, patched
We backport the security fixes to the Django release your application runs, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported Django release once your application can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.
All 10 known vulnerabilities in Django 4.2.30
OSV.dev, the open-source vulnerability database used by GitHub and Google, 28 October 2026, highest score first. Fixed in: the first upstream release with the fix, where OSV records it. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.
| CVE | Score | Severity | Published | Fixed in | Description |
|---|---|---|---|---|---|
| CVE-2026-15307 | 8.8 | High | 2026-08-04 | 5.2.17 | Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing |
| CVE-2026-15307 | 8.8 | High | 2026-10-01 | 5.2.17 | Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing |
| CVE-2026-53878 | 6.1 | Medium | 2026-07-07 | 5.2.16 | Django: DomainNameValidator permits newline characters that may enable HTTP header injection |
| CVE-2026-15830 | 5.3 | Medium | 2026-08-04 | 5.2.17 | Django GeoDjango vulnerable to denial of service through deeply nested geometry collections |
| CVE-2026-53877 | 4.8 | Medium | 2026-07-07 | 5.2.16 | Django: GDALRaster may over-read heap memory when constructed from bytes |
| CVE-2026-48587 | 3.1 | Low | 2026-06-03 | 5.2.15 | Django: has_vary_header may expose cached responses when Vary values contain whitespace |
| CVE-2026-48588 | 3.1 | Low | 2026-07-07 | 5.2.16 | Django: cache middleware may expose private responses when unrelated request cookies are present |
| CVE-2026-6873 | 3.1 | Low | 2026-06-03 | 5.2.15 | Django: signed cookies are vulnerable to salt namespace collisions |
| CVE-2026-8404 | 3.1 | Low | 2026-06-03 | 5.2.15 | Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling |
| CVE-2026-15830 | n/a | N/a | 2026-08-04 | 5.2.17 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue. |