PkgSeer

Vulnerability PYSEC-2026-2449

Low Risk

3 months ago

Django has a Race Condition vulnerability

4.2 - 4.2.28 and 5.2 - 5.2.11 and 6.0 - 6.0.2

Summary

Django has a Race Condition vulnerability

Details

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.

Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary umask change affects other threads in multi-threaded environments.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

1.0.1 - 5.2.16 and 6.0a1 - 6.0.7 PYSEC-2026-4035

Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

1.0.1 - 5.2.16 and 6.0a1 - 6.0.7 and 6.1a1 - 6.1 GHSA-q238-5cxm-5c9h

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

1.0.1 - 5.2.16 and 6.0a1 - 6.0.7 GHSA-wvqv-fj8w-qmhm

No summary available

1.0.1 - 5.2.16 and 6.0 - 6.0.7 PYSEC-2026-3717

Django vulnerable to Uncontrolled Resource Consumption

4.2 - 4.2.28 and 5.2 - 5.2.11 and 6.0 - 6.0.2 PYSEC-2026-2448

View all vulnerabilities for these packages

Impacted packages

django

Timeline

Published

3 months ago

Fixed (6.0.3)

8 months ago

Fixed (5.2.12)

8 months ago

Fixed (4.2.29)

8 months ago

Last Modified

3 months ago