Who contributed to Django on June 9, 2026?

1 developer shipped this update, including eevelweezel.

What were the notable Django updates?

Refs CVE-2026-48587 -- Added helper to properly split header values, Fixed #32785 -- Optimize cull frequency for DBCache, and Refs #16281 -- Fixed isolation of admin_views.ViewOnSiteTests.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO PATCHES HEADER PARSING VULNERABILITY AFFECTING CACHE AND SECURITY

By RepoJournal · Filed 06:00 UTC on June 9, 2026 · About Django

1 person shipped this

eevelweezel @eevelweezel 1 cited

Django shipped a critical fix for CVE-2026-48587 that rewrites how the framework parses HTTP header values, closing a whitespace-handling gap that could leave tokens improperly sanitized.

The security fix [1] extracts repeated split-and-strip logic into a new `split_header_value()` generator in django/utils/http.py. The old `cc_delim_re` regex only stripped whitespace around the comma delimiter itself, leaving leading or trailing whitespace intact on first and last tokens. RFC 9110 compliance means every token gets fully stripped now, not just the edges around delimiters. This matters because improper header parsing can cascade through cache headers, content-type values, and any comma-separated header field your app touches. In parallel, Django optimized DBCache culling [2] to run only every n queries instead of every query, a performance win for apps hammering the database cache layer. The team also fixed test isolation bugs [3] where cached Site instances were leaking database hints across test boundaries, causing unexpected writes to alternate databases. These aren't flashy features, but they're the kind of foundational fixes that prevent production surprises.

Action items

→ Review your custom header parsing code against the new split_header_value() helper django/django [plan]
→ Evaluate DBCache cull_frequency parameter in your settings if you're using database-backed caching django/django [monitor]
→ Pull the latest test isolation fixes if you maintain large test suites django/django [plan]

References

[1] Refs CVE-2026-48587 -- Added helper to properly split header values. django/django
[2] Fixed #32785 -- Optimize cull frequency for DBCache. ↗ django/django
[3] Refs #16281 -- Fixed isolation of admin_views.ViewOnSiteTests. django/django

Quick answers

What shipped in Django on June 9, 2026?: Django shipped a critical fix for CVE-2026-48587 that rewrites how the framework parses HTTP header values, closing a whitespace-handling gap that could leave tokens improperly sanitized. In total, 5 commits and 3 pull requests landed.
Who contributed to Django on June 9, 2026?: 1 developer shipped this update, including eevelweezel.
What were the notable Django updates?: Refs CVE-2026-48587 -- Added helper to properly split header values, Fixed #32785 -- Optimize cull frequency for DBCache, and Refs #16281 -- Fixed isolation of admin_views.ViewOnSiteTests.

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 1 day ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 2 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 3 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.