USN-8848-1: python-django Ubuntu

Vulnerability summary

USN-8848-1 is a vulnerability in python-django Ubuntu with no CVSS score yet.

Timeline

1. 30-09-2026
   PublishedVulnerability first disclosed.
2. 02-10-2026
   Last modifiedVulnerability information updated.

Description

python-django vulnerabilities Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write arbitrary files, or execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-15307) Ahmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly cached requests where the Vary header contained an asterisk. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-6907) Ahmed Badawe discovered that Django did not properly parse Cache-Control response directives case-insensitively under certain circumstances. A remote attacker could possibly use this issue to view sensitive information from responses that were incorrectly cached. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-8404)

No weakness data has been published for this record.