# What changed in django

> 30 changes in django 5 to 6 from its official release notes, upgrade guides and advisories: 30 security. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/django/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## django 6

### Security

- Django GeoDjango vulnerable to denial of service through deeply nested geometry collections (5.2.17, 6.0.8, 6.1.1) — [security advisory](https://github.com/advisories/GHSA-Q238-5CXM-5C9H)
- Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing (5.2.17, 6.0.8) — [security advisory](https://github.com/advisories/GHSA-WVQV-FJ8W-QMHM)
- Django: cache middleware may expose private responses when unrelated request cookies are present (5.2.16, 6.0.7) — [security advisory](https://github.com/advisories/GHSA-3H9F-R86X-QVJX)
- Django: DomainNameValidator permits newline characters that may enable HTTP header injection (5.2.16, 6.0.7) — [security advisory](https://github.com/advisories/GHSA-8QCX-XF44-272X)
- Django: GDALRaster may over-read heap memory when constructed from bytes (5.2.16, 6.0.7) — [security advisory](https://github.com/advisories/GHSA-CRHF-3PFG-W68W)
- Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake (5.2.15, 6.0.6) — [security advisory](https://github.com/advisories/GHSA-MM6V-Q8Q9-PGCF)
- Django: has_vary_header may expose cached responses when Vary values contain whitespace (5.2.15, 6.0.6) — [security advisory](https://github.com/advisories/GHSA-923M-GV2P-W5QP)
- Django: signed cookies are vulnerable to salt namespace collisions (5.2.15, 6.0.6) — [security advisory](https://github.com/advisories/GHSA-H7PC-VWP9-298G)
- Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling (5.2.15, 6.0.6) — [security advisory](https://github.com/advisories/GHSA-8CJM-8MP7-R2XF)
- Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary (5.2.15, 6.0.6) — [security advisory](https://github.com/advisories/GHSA-QPC8-7FXC-CM4P)
- Django has an Improper Handling of Length Parameter Inconsistency (5.2.14, 6.0.5) — [security advisory](https://github.com/advisories/GHSA-W26R-RMM8-9C29)
- Django Uses Cache Containing Sensitive Information (5.2.14, 6.0.5) — [security advisory](https://github.com/advisories/GHSA-5HRC-GVXJ-W55P)
- Django Uses Persistent Cookies Containing Sensitive Information (5.2.14, 6.0.5) — [security advisory](https://github.com/advisories/GHSA-7H2M-M8VJ-598H)
- Django has potential DoS via MultiPartParser through crafted multipart uploads (4.2.30, 5.2.13, 6.0.4) — [security advisory](https://github.com/advisories/GHSA-5MF9-H53Q-7MHQ)
- Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit (4.2.30, 5.2.13, 6.0.4) — [security advisory](https://github.com/advisories/GHSA-933H-HP56-HF7M)
- Django vulnerable to ASGI header spoofing via underscore/hyphen conflation (4.2.30, 5.2.13, 6.0.4) — [security advisory](https://github.com/advisories/GHSA-MVFQ-GGXM-9MC5)
- Django vulnerable to privilege abuse in GenericInlineModelAdmin (4.2.30, 5.2.13, 6.0.4) — [security advisory](https://github.com/advisories/GHSA-PWJP-CCJC-GHWG)
- Django vulnerable to privilege abuse in ModelAdmin.list_editable (4.2.30, 5.2.13, 6.0.4) — [security advisory](https://github.com/advisories/GHSA-MMWR-2JHP-MC7J)
- Django has a Race Condition vulnerability (4.2.29, 5.2.12, 6.0.3) — [security advisory](https://github.com/advisories/GHSA-MJGH-79QC-68W3)
- Django vulnerable to Uncontrolled Resource Consumption (4.2.29, 5.2.12, 6.0.3) — [security advisory](https://github.com/advisories/GHSA-8P8V-WH79-9R56)
- Django has an SQL Injection issue (4.2.28, 5.2.11, 6.0.2) — [security advisory](https://github.com/advisories/GHSA-6426-9FV3-65X8)
- Django has an SQL Injection issue (4.2.28, 5.2.11, 6.0.2) — [security advisory](https://github.com/advisories/GHSA-GVG8-93H5-G6QQ)
- Django has an SQL Injection issue (4.2.28, 5.2.11, 6.0.2) — [security advisory](https://github.com/advisories/GHSA-MWM9-4648-F68Q)
- Django has Inefficient Algorithmic Complexity (4.2.28, 5.2.11, 6.0.2) — [security advisory](https://github.com/advisories/GHSA-33MW-Q7RJ-MJWJ)
- Django has Inefficient Algorithmic Complexity (4.2.28, 5.2.11, 6.0.2) — [security advisory](https://github.com/advisories/GHSA-4RRR-2H4V-F3J9)
- Django has Observable Timing Discrepancy (4.2.28, 5.2.11, 6.0.2) — [security advisory](https://github.com/advisories/GHSA-2MCM-79HX-8FXW)

## django 5

### Security

- Django is vulnerable to DoS via XML serializer text extraction (4.2.27, 5.1.15, 5.2.9) — [security advisory](https://github.com/advisories/GHSA-VRCR-9HJ9-JCG6)
- Django is vulnerable to SQL injection in column aliases (4.2.27, 5.1.15, 5.2.9) — [security advisory](https://github.com/advisories/GHSA-RQW2-GHQ9-44M7)
- Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows (4.2.26, 5.1.14, 5.2.8) — [security advisory](https://github.com/advisories/GHSA-QW25-V68C-QJF3)
- Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects. (4.2.26, 5.1.14, 5.2.8) — [security advisory](https://github.com/advisories/GHSA-FRMV-PR5F-9MCR)