April 7, 2026
Django 4.2.30 fixes one security issue with severity « moderate » and four security issues with severity « low » in 4.2.29.
ASGIRequest normalizes header names following WSGI conventions, mapping
hyphens to underscores. As a result, even in configurations where reverse
proxies carefully strip security-sensitive headers named with hyphens, such a
header could be spoofed by supplying a header named with underscores.
Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous
mappings. (Django’s runserver was patched in CVE 2015-0219.) But
under ASGI, there is not the same uniform expectation, even if many proxies
protect against this under default configuration (including nginx via
underscores_in_headers off;).
Headers containing underscores are now ignored by ASGIRequest, matching the
behavior of Daphne, the reference server for ASGI.
This issue has severity « low » according to the Django security policy.
GenericInlineModelAdmin¶Add permissions on inline model instances were not validated on submission of
forged POST data in
GenericInlineModelAdmin.
This issue has severity « low » according to the Django security policy.
ModelAdmin.list_editable¶Admin changelist forms using
list_editable incorrectly allowed new
instances to be created via forged POST data.
This issue has severity « low » according to the Django security policy.
MultiPartParser via base64-encoded file upload¶When using django.http.multipartparser.MultiPartParser, multipart uploads
with Content-Transfer-Encoding: base64 that include excessive whitespace
may trigger repeated memory copying, potentially degrading performance.
This issue has severity « moderate » according to the Django security policy.
ASGI requests with a missing or understated Content-Length header could
bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading
HttpRequest.body, potentially loading an unbounded request body into
memory and causing service degradation.
This issue has severity « low » according to the Django security policy.
août 05, 2026