Django CVEs 2024 — Complete Security Release List

Updated March 2026 · PackageFix · Safe version: 5.1.4+ or 4.2.17+

Django had 14 security releases in 2024 — the most active year for Django CVEs in recent history. Highlights include a CRITICAL SQL injection (CVE-2024-42005) and multiple ReDoS vulnerabilities in template filters. This page covers every CVE with the exact patch version.

All Django 2024 CVEs

Current safe versions

# Django 4.2 LTS (supported until April 2026)
Django==4.2.17

# Django 5.1 (latest)
Django==5.1.4

# Update
pip install Django==5.1.4
# Verify
python -c "import django; print(django.__version__)"

The CRITICAL CVE: SQL injection via QuerySet.values()

CVE-2024-42005 (CVSS CRITICAL) allows SQL injection via QuerySet.values() and values_list() with user-controlled field names. Any Django application that passes user input as field names to these queryset methods is vulnerable. This was patched in Django 4.2.15 and 5.0.8 released in August 2024.

Example of vulnerable code pattern:

# VULNERABLE - field name from user input
fields = request.GET.getlist("fields")
MyModel.objects.values(*fields)

# SAFE - allowlist field names
ALLOWED_FIELDS = {"name", "email", "created_at"}
fields = [f for f in request.GET.getlist("fields") if f in ALLOWED_FIELDS]
MyModel.objects.values(*fields)

The ReDoS pattern in 2024

Six of Django's 2024 CVEs are ReDoS vulnerabilities in template filters — intcomma, strip_tags, urlize, urlizetrunc, and urlfield. Django uses regex for text processing in these filters. A crafted string passed to any of these filters can cause the template engine to hang. Most are fixed by replacing backtracking regex with linear-time alternatives.