{"id":"SUSE-SU-2026:3503-1","summary":"Security update for python-Django","details":"This update for python-Django fixes the following issues:\n\n- CVE-2026-15307: server-side file-write and request forgery via spatial lookups (bsc#1272997).\n- CVE-2026-15337: potential denial-of-service vulnerability in `check_for_language()` (bsc#1272998).\n- CVE-2026-15830: potential denial-of-service vulnerability via nested geometry collections (bsc#1272999).\n- CVE-2026-15920: potential cross-site scripting via `URLField` values in the admin (bsc#1273000).\n","modified":"2026-08-06T11:15:05.658250119Z","published":"2026-08-05T12:49:57Z","related":["CVE-2026-15307","CVE-2026-15337","CVE-2026-15830","CVE-2026-15920"],"upstream":["CVE-2026-15307","CVE-2026-15337","CVE-2026-15830","CVE-2026-15920"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263503-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272997"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272998"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272999"},{"type":"REPORT","url":"https://bugzilla.suse.com/1273000"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-15307"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-15337"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-15830"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-15920"}],"affected":[{"package":{"name":"python-Django","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","purl":"pkg:rpm/suse/python-Django&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.65.1"}]}],"ecosystem_specific":{"binaries":[{"python311-Django":"4.2.11-150600.3.65.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3503-1.json"}}],"schema_version":"1.8.0"}