-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 11 Nov 2026 14:29:18 -0800 Source: python-django Architecture: source Version: 3:3.2.25-0+deb12u7 Distribution: bookworm-security Urgency: high Maintainer: Debian Python Team <team+python@tracker.debian.org> Changed-By: Chris Lamb <lamby@debian.org> Changes: python-django (3:3.2.25-0+deb12u7) bookworm-security; urgency=high . * Non-maintainer upload by the LTS security team. * CVE-2026-108147: Prevent a potential memory exhaustion in MultiPartParser via base64-encoded file uploads. When using django.http.multipartparser's MultiPartParser, multipart uploads with a "Content-Transfer-Encoding: base64" header could be buffered entirely in memory regardless of the value of FILE_UPLOAD_MAX_MEMORY_SIZE before being passed to upload handlers, potentially consuming excessive memory. * CVE-2026-113593: Avoid a potential exposure of private data via empty and missing 'Vary' headers. UpdateCacheMiddleware and cache_page() generated the same cache key for a request that omitted a header listed in the response's 'Vary' header and a request that sent that header with an empty value. As a result, a response cached for one of these requests could be served to the other which could lead to the exposure of private data. Cache keys now distinguish between absent and empty header values as required by RFC 9111#section-4.1. Responses previously cached for requests that omitted a header listed in 'Vary' will no longer be matched and will be cached again on the next request. Checksums-Sha1: 50756a3718cb99f25ae54b50ef1ee6199ff05cba 2837 python-django_3.2.25-0+deb12u7.dsc a706db3607e3cc567ea4a172589f1360a614a6c6 9836336 python-django_3.2.25.orig.tar.gz 677f0280c8300ab2b0b1ab5ac675dea497b47441 75716 python-django_3.2.25-0+deb12u7.debian.tar.xz 5bdb825e45116c702dbad9751d14d51829afd031 7853 python-django_3.2.25-0+deb12u7_source.buildinfo Checksums-Sha256: b580078a8ac730cd28a668634b273365951e1f708ba40a8c5b57f110150f0415 2837 python-django_3.2.25-0+deb12u7.dsc 7ca38a78654aee72378594d63e51636c04b8e28574f5505dff630895b5472777 9836336 python-django_3.2.25.orig.tar.gz 77eef03a19da1e1f5c4f0dc8e75c7a5733dda3557c5e65d48aa800ecddbfdd9e 75716 python-django_3.2.25-0+deb12u7.debian.tar.xz d3cb0c98b670a48279baa3cf2f168cc7375083d55380514487e09eafff7abbc9 7853 python-django_3.2.25-0+deb12u7_source.buildinfo Files: 041d4fba56a66aca48f4619d52c48209 2837 python optional python-django_3.2.25-0+deb12u7.dsc a16a8c39121acf9a84433bf0c616d575 9836336 python optional python-django_3.2.25.orig.tar.gz fb4df55180940407ab55cd0b6c2dc41d 75716 python optional python-django_3.2.25-0+deb12u7.debian.tar.xz 77cdf107e46ae981f30789004fd18d8c 7853 python optional python-django_3.2.25-0+deb12u7_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmr2N+QACgkQHpU+J9Qx Hli31Q//cC3bqnaG0DLLZPSZqhsazN5P/LiNugAF83DoOMaLILVm26BBFn+OWOh6 F03xLPuTdE3gdp3pFJgOQpWzLTWG6a/K+QlkY8KQtv7qFV8Kr9pWnEv/ms/kERS8 3i22C/+tGUd1gp7SCGgjN4iOv8kUJ8t2WGhi+1gOyZghPgY4WzOuu4x4vehXx6qn 7biIIZJdd/6dmcvbeLnCB0W23OmxS8Y5wu+YtN1Y2FZ9YIak/89RogOFipoWxhnp 9VehW2A+GYO0X5hR9SV99H7dJRZ7mxCV3j3AWek+yzmznvWHpml5bae2BMGNT8Mx Ms+k+xlzSh9yPJbirSMVcYD/6X30C4iYzdmJxMCLyVX2e26IMamSfQ9Ayz1vHCQA Cn661uvWRsVDOs0IYrf1C8mNAz5YrTm5Pn24ILbxjwxAsiojGDySdhvpGfaAIerm oRldCGruIkz9HHEl6nP7uf73UAF4GtGNYWwMG598kesrM7/Nkfwp6ytyevQb3KPZ oawuS++E2qsUXns7w9CADNbg2UjQl9PIveXcp8nMKIBt73OgjZhRj/UBu9XlB1wo vdAPO+VqbwIbFM2ebulL7GaL/6wdvjc9IFMC82dcm5eFyNTkfYtKOYREdhf6NM5P gnj/SzuWQ/XO15I5BA9kM5xJqY19rhf0hMh4Gi2BNw0doOFxfxs= =FZ5z -----END PGP SIGNATURE-----
