Repository navigation

[pull] main from django:main - #282

Merged

pull[bot] merged 10 commits into

threatcode:mainfrom

Feb 3, 2026

Merged

[pull] main from django:main#282
pull[bot] merged 10 commits into
threatcode:mainfrom
django:main

Commits on Feb 3, 2026
- Fixed CVE-2025-13473 -- Standardized timing of check_password() in mod_wsgi auth handler.
  
  authored and
  jacobtylerwalls
  committed
  3eb814e
- Fixed CVE-2025-14550 -- Optimized repeated header parsing in ASGI requests.
  
  RealOrangeOne
  authored and
  jacobtylerwalls
  committed
  eb22e1d
- Fixed CVE-2026-1207 -- Prevented SQL injections in RasterField lookups via band index.
  jacobtylerwalls
  committed
  81aa529
- Fixed CVE-2026-1285 -- Mitigated potential DoS in django.utils.text.Truncator for HTML input.
  
  nessita
  authored and
  jacobtylerwalls
  committed
  a33540b
- Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.
  
  RealOrangeOne
  authored and
  jacobtylerwalls
  committed
  e891a84
- Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via aliases with periods.
  jacobtylerwalls
  committed
  69065ca
- Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods.
  jacobtylerwalls
  committed
  005d60d
- Added stub release notes for 6.0.3.
  jacobtylerwalls
  committed
  e7e43f1
- Added CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285, CVE-2026-1287, and CVE-2026-1312 to security archive.
  jacobtylerwalls
  committed
  af361d3
- Fixed #36898 -- Documented SessionBase.is_empty().
  
  jafarkhan83
  authored and
  jacobtylerwalls
  committed
  13299a6