fix(deps): update dependency django [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
Django (changelog)	==4.2.17 -> ==4.2.21
Django (changelog)	==3.2.25 -> ==4.2.16
Django (changelog)	==2.2.28 -> ==4.2.16
django (changelog)	>=2.2 -> >=4.2.21
django (changelog)	>= 1.10 -> >=4.2.21

---

BIT-django-2024-56374 / CVE-2024-56374 / GHSA-qcgg-j2x8-h9g8 / PYSEC-2025-1

More information

Details

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)

Severity

Unknown

References

• https://www.djangoproject.com/weblog/2025/jan/14/security-releases/
• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• http://www.openwall.com/lists/oss-security/2025/01/14/2

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Django has a potential denial-of-service vulnerability in IPv6 validation

BIT-django-2024-56374 / CVE-2024-56374 / GHSA-qcgg-j2x8-h9g8 / PYSEC-2025-1

More information

Details

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)

Severity

• CVSS Score: 5.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-56374
• https://github.com/django/django/commit/ca2be7724e1244a4cb723de40a070f873c6e94bf
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-1.yaml
• https://groups.google.com/g/django-announce
• https://lists.debian.org/debian-lts-announce/2025/01/msg00024.html
• https://www.djangoproject.com/weblog/2025/jan/14/security-releases
• http://www.openwall.com/lists/oss-security/2025/01/14/2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

BIT-django-2025-26699 / CVE-2025-26699 / GHSA-p3fp-8748-vqfq / PYSEC-2025-13

More information

Details

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

Severity

Unknown

References

• https://www.djangoproject.com/weblog/2025/mar/06/security-releases/
• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• http://www.openwall.com/lists/oss-security/2025/03/06/12
• https://lists.debian.org/debian-lts-announce/2025/03/msg00012.html

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Django vulnerable to Allocation of Resources Without Limits or Throttling

BIT-django-2025-26699 / CVE-2025-26699 / GHSA-p3fp-8748-vqfq / PYSEC-2025-13

More information

Details

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

Severity

• CVSS Score: 5.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-26699
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-13.yaml
• https://groups.google.com/g/django-announce
• https://lists.debian.org/debian-lts-announce/2025/03/msg00012.html
• https://www.djangoproject.com/weblog/2025/mar/06/security-releases
• http://www.openwall.com/lists/oss-security/2025/03/06/12

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django has a denial-of-service possibility in strip_tags()

CVE-2025-32873 / GHSA-8j24-cjrq-gr2m / PYSEC-2025-37

More information

Details

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-32873
• https://github.com/django/django/commit/9f3419b519799d69f2aba70b9d25abe2e70d03e0
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-37.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/may/07/security-releases
• http://www.openwall.com/lists/oss-security/2025/05/07/1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

CVE-2025-32873 / GHSA-8j24-cjrq-gr2m / PYSEC-2025-37

More information

Details

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

Severity

Unknown

References

• https://www.djangoproject.com/weblog/2025/may/07/security-releases/
• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• http://www.openwall.com/lists/oss-security/2025/05/07/1

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Django allows enumeration of user e-mail addresses

BIT-django-2024-45231 / CVE-2024-45231 / GHSA-rrqc-c2jx-6jgv

More information

Details

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-45231
• https://github.com/django/django/commit/3c733c78d6f8e50296d6e248968b6516c92a53ca
• https://github.com/django/django/commit/96d84047715ea1715b4bd1594e46122b8a77b9e2
• https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/sep/03/security-releases

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to Reflected File Download attack

BIT-django-2022-36359 / CVE-2022-36359 / GHSA-8x94-hmjh-97hq / PYSEC-2022-245

More information

Details

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-36359
• https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b80
• https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb3
• https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
• https://docs.djangoproject.com/en/4.0/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml
• https://groups.google.com/g/django-announce/c/8cz--gvaJr4
• https://lists.fedoraproject.org/archives/list/[email protected]/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/[email protected]/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://security.netapp.com/advisory/ntap-20220915-0008
• https://www.debian.org/security/2022/dsa-5254
• https://www.djangoproject.com/weblog/2022/aug/03/security-releases
• http://www.openwall.com/lists/oss-security/2022/08/03/1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

django/django (Django)

v4.2.21

Compare Source

v4.2.20

Compare Source

v4.2.19

Compare Source

v4.2.18

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.