Django releases three security versions: framework updates also need compatibility testing
Django released 6.1.2, 6.0.9 and 5.2.18 to address language-code handling, HTTP header parsing and other security issues, while strengthening earlier fixes. Some changes alter how specific inputs are handled, so website maintenance should include testing.
Source Facts
The Django team released 6.1.2, 6.0.9 and 5.2.18 on 6 October. The advisory lists four security issues and strengthens an existing fix, covering language-code caching, HTTP header parsing, spatial queries and model formsets.
The advisory notes that parsing results for some malformed HTTP headers may change. Certain byte inputs in spatial queries must also be explicitly wrapped in a specified object. These changes concern specific conditions; users are encouraged to update supported versions.
Confirm framework and dependency versions with the website developer. After backing up, test logins, forms and language switching. Do not update only the site's appearance while ignoring underlying software.
Original sources
Django security releases issued: 6.1.2, 6.0.9, and 5.2.18
Sources checked: 2026-10-25 · Compiled with SI agent assistance; not individually reviewed by a human.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationAmazon Linux updates its Docker security advisory: check container hosts and archive handling
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
Illustration