fix(deps): update dependency django to v6.0.8 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
django (changelog)	==6.0.6 → ==6.0.8

---

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

CVE-2026-53878 / GHSA-8qcx-xf44-272x

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
DomainNameValidator does not prohibit newlines in domain names (unless used via a form field, since CharField strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53878
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/3a720d0d8bf2529253b98968f10ca73daf6d693c
• https://github.com/django/django/commit/a5de13f1491f1dbf2bb0ad9b91570524ebbc8acd
• https://github.com/django/django/commit/d5d60ed0323cddaa0ce0237a26a3d49ac21ee05e
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2092.yaml
• https://github.com/advisories/GHSA-8qcx-xf44-272x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: GDALRaster may over-read heap memory when constructed from bytes

CVE-2026-53877 / GHSA-crhf-3pfg-w68w

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
django.contrib.gis.gdal.GDALRaster over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the vsi_buffer property is accessed.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53877
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/38dfbd27d7d4f4e6eaa087d7a90f2613fbf55b3a
• https://github.com/django/django/commit/6c66eb8cec52b303af85c2c6e4dd00aa37654dbc
• https://github.com/django/django/commit/6ca2bbe2efce21010eff48f1f36a3f621d698ed8
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2091.yaml
• https://github.com/advisories/GHSA-crhf-3pfg-w68w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django: cache middleware may expose private responses when unrelated request cookies are present

CVE-2026-48588 / GHSA-3h9f-r86x-qvjx

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
UpdateCacheMiddleware and the cache_page() decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Chris Whyland for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-48588
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases
• https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3
• https://github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1
• https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yaml
• https://github.com/advisories/GHSA-3h9f-r86x-qvjx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

CVE-2026-15830 / GHSA-q238-5cxm-5c9h

More information

Details

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-15830
• https://github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6
• https://github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06
• https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080
• https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0d
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/aug/04/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-3717.yaml
• https://github.com/advisories/GHSA-q238-5cxm-5c9h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

CVE-2026-15307 / GHSA-wvqv-fj8w-qmhm

More information

Details

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or RasterField reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A dict, or a str holding its JSON representation, is opened in write mode regardless of the constructor's write=False default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other str is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-15307
• https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e
• https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa
• https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6
• https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/aug/04/security-releases
• https://github.com/advisories/GHSA-wvqv-fj8w-qmhm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

django/django (django)

v6.0.8

Compare Source

v6.0.7

Compare Source

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.