openSUSE-SU-2026:22196-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22196-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22196-1
- Upstream
- Related
- Published
- 2026-10-28T02:17:09Z
- Modified
- 2026-11-01T17:23:29Z
- Summary
- Security update for python-Django
- Details
-
This update for python-Django fixes the following issues:
Changes in python-Django:
- CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting queryset, without any permission on the targeted object, marking an out-of-queryset object for deletion (bsc#1284471)
- CVE-2026-87890: An incomplete fix for CVE-2026-15307 in Django
spatial lookups allows an attacker who can supply
bytesvalues to cause the Django process to make network requests via a crafted VRT document (bsc#1284472) - CVE-2026-84429: potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter (bsc#1284476)
- CVE-2026-77050: potential denial-of-service in
get_supported_language_variant()when processing many distinct, very long language codes (bsc#1284481)
- References
-
- https://bugzilla.suse.com/1284471
- https://bugzilla.suse.com/1284472
- https://bugzilla.suse.com/1284476
- https://bugzilla.suse.com/1284481
- https://www.suse.com/security/cve/CVE-2026-77050
- https://www.suse.com/security/cve/CVE-2026-84429
- https://www.suse.com/security/cve/CVE-2026-87890
- https://www.suse.com/security/cve/CVE-2026-87975