Advisories » MGASA-2026-0591

Updated python-django package fixes security vulnerabilities

Publication date: 12 Nov 2026
Modification date: 12 Nov 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-108147 , CVE-2026-111211 , CVE-2026-111362 , CVE-2026-113593 , CVE-2026-113733 , CVE-2026-114582

Description

CVE-2026-108147: Potential memory exhaustion in `MultiPartParser` via
base64-encoded file upload
CVE-2026-111211: Potential log injection via unescaped geometry form
values
CVE-2026-111362: Server-side request forgery via crs member of GeoJSON
geometries
CVE-2026-113593: Potential exposure of private data via empty and
missing `Vary` headers
CVE-2026-113733: Password hash disclosure to "view only" admin users
with custom user models
CVE-2026-114582: Server-side request forgery via `SpatialReference`
string input
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36683
• https://www.openwall.com/lists/oss-security/2026/11/03/8
• https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
• https://www.cve.org/CVERecord?id=CVE-2026-108147
• https://www.cve.org/CVERecord?id=CVE-2026-111211
• https://www.cve.org/CVERecord?id=CVE-2026-111362
• https://www.cve.org/CVERecord?id=CVE-2026-113593
• https://www.cve.org/CVERecord?id=CVE-2026-113733
• https://www.cve.org/CVERecord?id=CVE-2026-114582

SRPMS

10/core

• python-django-5.2.19-1.mga10