The Wire · Showcase
DJANGO TIGHTENS SECURITY ON HTTP HEADERS AND ADMIN QUERYSETS
By RepoJournal · Filed · About Django
Django patched control character injection in HttpResponse headers and fixed a critical inconsistency where admin change forms ignored custom queryset filtering.
The security fix [1] blocks control characters in HttpResponse reason_phrase attributes, preventing header injection attacks that could slip malicious content past validators. This closes a gap that existed because the reason_phrase setter had no validation, making it a clear exploit vector. On the admin side, a consistency fix [2] resolves ticket #37117 by making change form actions respect ModelAdmin.get_queryset() the same way the change list does [3]. Before this patch, admins with custom queryset logic (annotations, stricter filtering, custom managers) would see different data in the change form than in the list, creating silent data integrity issues. The djangoproject.com release checklist was also prepped for the next alpha cycle [4] with branch protection rule automation and ReadTheDocs corrections [5] [6], setting the pipeline for smoother future releases.
Action items
- → Review admin change forms for custom get_queryset() logic and test against this patch django/django [plan]
- → Audit any code setting HttpResponse reason_phrase with user input django/django [immediate]
- → Watch djangoproject.com release checklist changes for alpha branch workflow updates django/djangoproject.com [monitor]
References
- [1] Fixed #37100 -- Prevented control characters in HttpResponse reason_phrase. ↗ django/django
- [2] Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions. ↗ django/django
- [3] Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions. django/django
- [4] [checklists] Removed stable branch prefix from feature freeze man page update. django/djangoproject.com
- [5] [checklists] Fixed typo in ReadTheDocs search step. django/djangoproject.com
- [6] [checklists] Updates after 6.1 alpha ↗ django/djangoproject.com
FAQ
- What changed in Django on May 23, 2026?
- Django patched control character injection in HttpResponse headers and fixed a critical inconsistency where admin change forms ignored custom queryset filtering.
- What should Django teams do about it?
- Review admin change forms for custom get_queryset() logic and test against this patch • Audit any code setting HttpResponse reason_phrase with user input • Watch djangoproject.com release checklist changes for alpha branch workflow updates
- Which Django repositories shipped on May 23, 2026?
- django/django, django/djangoproject.com