$ the-wire · showcase
Django ships five security fixes, including formsets and spatial lookups
By RepoJournal · Filed · About Django · Composed from the cited sources · methodology
Five CVE fixes landed in django/django in the last day, covering formset PK forging, WKB geometry limits, bytes in spatial lookups, and header parsing, and each one changes behavior your code may depend on.
Fixed CVE-2026-87975 -- Prevented forging actions in model formsets with editable PKs. django/django
Model formsets with editable primary keys could be tricked into deleting instances outside the formset's queryset, and edit-only formsets could be tricked into creating instances, by forging POST data. An object outside the queryset is represented by a newly constructed instance whose PK can still be populated, since BaseInlineFormSet sets the parent link when it is also the primary key and con...
Refs CVE-2026-15830 -- Fixed WKB geometry collection limit bypasses. django/django
The WKB geometry collection limiter was bypassable three ways: invalid byte-order markers that GEOS tolerates, recursively nested multi-geometries such as a MULTIPOINT inside a MULTIPOINT, and big-endian ISO HEXWKB, where geometry types were unconditionally byte-swapped. Byte-pattern scanning was replaced with a lightweight structural WKB scan, which also stops rejecting some valid inputs.
Fixed CVE-2026-87890 -- Blocked bytes in spatial lookups. django/django
Raster values passed through spatial lookups as bytes write to the in-memory virtual filesystem, but that does not prevent network fetches when resolving references, so bytes are now blocked in spatial lookups. Reported by sicksec, reviewed by Jacob Walls, Jake Howard, and David Smith.
Fixed CVE-2026-84429 -- Simplified parse_header_parameters by leveraging stdlib's Message. django/django
parse_header_parameters was rebuilt on stdlib's email.message.Message, closing a hole left by the earlier work to inline the deprecated cgi module's logic and then clean it up. Header parsing now follows the standard library rather than the hand-maintained path.
Added CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975 to security archive. django/django
The archived set grows to include CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975, alongside the django-asv run recording fresh ubuntu-latest benchmark results and the sponsorship plan matrix on djangoproject.com moving to flat icons with screen-reader labels like "Gold Included".
Action items
