-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 13 Oct 2026 14:33:55 -0700 Source: python-django Architecture: source Version: 3:3.2.25-0+deb12u6 Distribution: bookworm-security Urgency: high Maintainer: Debian Python Team <team+python@tracker.debian.org> Changed-By: Chris Lamb <lamby@debian.org> Changes: python-django (3:3.2.25-0+deb12u6) bookworm-security; urgency=high . * Non-maintainer upload by the LTS security team. * CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant. This method was subject to a potential denial-of-service attack when processing many distinct and very long language codes. Language codes were used as keys in an in-memory cache before their length was limited, potentially consuming excessive process memory. To mitigate this vulnerability, language codes longer than 500 characters are now rejected or truncated before the cached lookup. * CVE-2026-87975: Prevent privilege abuse in model formsets with editable primary keys. Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model's primary key could be set through the form, such as with a OneToOneField (or parent link used as the primary key of an inline formset's model), or a natural or UUID primary key included in the form's fields. Models using the default BigAutoField primary key were not affected. * Workaround changes to recent changes to Python's HTMLParser. Various changes were made to CPython's built-in HTMLParser library, including and excluding inputs that were valid/invalid before. As these changes caused a regression in Django's testsuite, we apply an upstream patch by Natalia to ensure the testsuite passes again. Checksums-Sha1: 75db20adc1b376b1553df17dc25909f8adb5a6dd 2837 python-django_3.2.25-0+deb12u6.dsc a706db3607e3cc567ea4a172589f1360a614a6c6 9836336 python-django_3.2.25.orig.tar.gz 93c0cd93b81fcf4c138cce7b6576ab94c0e8a34a 73660 python-django_3.2.25-0+deb12u6.debian.tar.xz c902c686206c4d2178d5abcd992d4184d94b9dae 7672 python-django_3.2.25-0+deb12u6_source.buildinfo Checksums-Sha256: 88bf05b726e0810895ea719415aabac57d42bd0df0b73728634a268b67ed3b75 2837 python-django_3.2.25-0+deb12u6.dsc 7ca38a78654aee72378594d63e51636c04b8e28574f5505dff630895b5472777 9836336 python-django_3.2.25.orig.tar.gz aebf754a74097717c05448e0e4b8181333c2194e675811679577f2761c1fe92c 73660 python-django_3.2.25-0+deb12u6.debian.tar.xz 952393e601220313fa869d31cbf9cc2c2c524515dd70196e497d8aa2051745b2 7672 python-django_3.2.25-0+deb12u6_source.buildinfo Files: 5f49f15086a61bd57ea137216d4fe504 2837 python optional python-django_3.2.25-0+deb12u6.dsc a16a8c39121acf9a84433bf0c616d575 9836336 python optional python-django_3.2.25.orig.tar.gz 00743ead16752564eac317dc73781b60 73660 python optional python-django_3.2.25-0+deb12u6.debian.tar.xz 028c44c98cd4052ee4814fea6e6649b0 7672 python optional python-django_3.2.25-0+deb12u6_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmrWw/kACgkQHpU+J9Qx HlhGsw/+L+rbHOwfb081rP8uUjG6r3bIZuoY1FURg5frZKYYA1cOrLnWsy0j/UX7 FMuSab7hMcxzCy0KkCNhcwatZvOGtY0Xm8UDZPz9T0BDRr+L8+WCZh5x4e9y7y43 Et94vnHHlgTczlRx49DLwBj0mgTw2RDaMYLMi/y52sp0LqOCnaKXtFrXVxgWB9XG yHDm1+nXiTrHDCwfHCsyBDKJMS6TpeYrQ6OBsbiziM0szmsDz73FgCwb28PUw5MQ w9H4uRilca6pl02YZFEKJHiA5Puj1NToHS7uffIaHa/kjslR6jecYE8T4gJhPoqK eQZXWWx6IN2ieHsXP62uL69LR0uxLxUXBfb2Pv05nmFf2hr+jISQTv5wM4BqMeZF BWzkjbI6Xtu8HvpY+rcMTfxrFvc1uRlB0zZcUebWK+8SIQc8D1atlrMz4PeGS2kd 5zGkeoGi8fAlEukg44EukWl2gZcw8dWXXF/A2zvpjxyP6klqN+iTqln78WMZPhsN P3yjiVrYFK62t28rYPLI91lqtO85X+CGtOxGAEj3J5m69we3RDMIybqqYy99XwtD zoWaeKwD36x+mQtvUPwJsQBemValQhN5v2LgvNpRRlnz/kd4EmFuruvqhSpuW4sK xNO2iymT89t4KaARmd6VL9lRmhMqWDUAoupTWVCE9jo9VDH8KVE= =BMzU -----END PGP SIGNATURE-----
