<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/django-security-releases-issued-6-1-3-6-0-10-and-5-2-19-guitwusia" -->

---
title: Django security releases issued: 6.1.3, 6.0.10, and 5.2.19
description: Django has issued security releases 6.1.3, 6.0.10, and 5.2.19 fixing six CVEs. CVE-2026-111362 is a moderate-severity SSRF where a malicious CRS reference in...
canonical: https://daily.dev/posts/django-security-releases-issued-6-1-3-6-0-10-and-5-2-19-guitwusia
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Django security releases issued: 6.1.3, 6.0.10, and 5.2.19 | daily.dev
og:description: Django has issued security releases 6.1.3, 6.0.10, and 5.2.19 fixing six CVEs. CVE-2026-111362 is a moderate-severity SSRF where a malicious CRS reference in...
og:url: https://daily.dev/posts/django-security-releases-issued-6-1-3-6-0-10-and-5-2-19-guitwusia
og:image: https://api.daily.dev/og/posts/guITWuSIA.png
og:image:alt: Django security releases issued: 6.1.3, 6.0.10, and 5.2.19
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Django security releases issued: 6.1.3, 6.0.10, and 5.2.19

**[Django](https://daily.dev/sources/django)** · 6 min read · 0 upvotes · 0 comments

## Summary

Django has issued security releases 6.1.3, 6.0.10, and 5.2.19 fixing six CVEs. CVE-2026-111362 is a moderate-severity SSRF where a malicious CRS reference in GeoJSON geometry input could make Django issue network requests or read files as the server process. CVE-2026-114582 affects SpatialReference and transform methods, requiring GDAL 3.9 or later for full protection. Other low-severity fixes address MultiPartParser memory exhaustion from base64 uploads, log injection via GeometryField, cache key confusion from missing Vary headers, and password hash exposure to view-only admin users. Users are encouraged to upgrade as soon as possible.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.djangoproject.com/weblog/2026/nov/03/security-releases>

## Questions this post answers

### What does CVE-2026-111362 in Django let an attacker do with GeoJSON geometry fields?

It allows server-side request forgery: a malicious coordinate reference system (CRS) URL embedded in a GeoJSON geometry gets resolved by GDAL, making the Django process issue an outbound network request or read a local file. Any validation, save, or query path that instantiates a geometry from user input was exposed. Django now rejects GeoJSON CRS references to external resources in lookups, the GeometryField form field, and GEOSGeometry.

_Teams running GeoDjango can track SSRF fixes like this one on daily.dev before deploying to production._

### How do I protect Django's SpatialReference from SSRF via string input on GDAL?

Django's SpatialReference now disables network and file access when parsing string input on GDAL 3.9 or later, but full protection requires that GDAL version. On older GDAL versions, prefer integer SRIDs looked up directly in the EPSG database, or compare string input against an allow list; dictionary references using the DICT: or ESRI:: prefix are rejected on all GDAL versions. A new gis.W001 system check warns when GDAL is below 3.9.

_Developers patching GIS stacks can follow GDAL-related Django advisories like this on daily.dev._

### Can Django admin view-only users see password hashes for custom user models?

Yes, prior to CVE-2026-113733's fix, admin users with view (but not change) permission on a user model were shown the entire password hash when that model was not AUTH_USER_MODEL, or when AUTH_USER_MODEL inherited its password field from a concrete parent model via multi-table inheritance. This is fixed in Django 6.1.3, 6.0.10, and 5.2.19.

_Admin permission edge cases like this are easy to track down via daily.dev when auditing Django security releases._

## Similar posts on daily.dev

- [Django’s October 2026 Security Release: What the Four CVEs Mean for Your App](https://daily.dev/posts/django-s-october-2026-security-release-what-the-four-cves-mean-for-your-app-3jq4ojbhv) · Medium · 0 upvotes · 0 comments
- [Issue 340: Django security releases 6.0.6 and 5.2.15](https://daily.dev/posts/issue-340-django-security-releases-6-0-6-and-5-2-15-0r7w6h8w1) · Django News · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#django](https://daily.dev/tags/django)

[View this post on daily.dev](https://daily.dev/posts/django-security-releases-issued-6-1-3-6-0-10-and-5-2-19-guitwusia)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Django security releases issued: 6.1.3, 6.0.10, and 5.2.19","url":"https://daily.dev/posts/django-security-releases-issued-6-1-3-6-0-10-and-5-2-19-guitwusia","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/django-security-releases-issued-6-1-3-6-0-10-and-5-2-19-guitwusia"},"datePublished":"2026-11-03T15:42:25.135Z","dateModified":"2026-11-03T15:51:03.487Z","description":"Django has issued security releases 6.1.3, 6.0.10, and 5.2.19 fixing six CVEs. CVE-2026-111362 is a moderate-severity SSRF where a malicious CRS reference in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/71538c3530bf6c6bbacb396cf5ffc721?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/71538c3530bf6c6bbacb396cf5ffc721?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Django","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Django","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/4a658d547a52423e99fe641ecc576195","url":"https://daily.dev/sources/django"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/django-security-releases-issued-6-1-3-6-0-10-and-5-2-19-guitwusia","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,django","timeRequired":"PT6M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Django","item":"https://daily.dev/sources/django"},{"@type":"ListItem","position":3,"name":"Django security releases issued: 6.1.3, 6.0.10, and 5.2.19"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/django-security-releases-issued-6-1-3-6-0-10-and-5-2-19-guitwusia#faq","mainEntity":[{"@type":"Question","name":"What does CVE-2026-111362 in Django let an attacker do with GeoJSON geometry fields?","acceptedAnswer":{"@type":"Answer","text":"It allows server-side request forgery: a malicious coordinate reference system (CRS) URL embedded in a GeoJSON geometry gets resolved by GDAL, making the Django process issue an outbound network request or read a local file. Any validation, save, or query path that instantiates a geometry from user input was exposed. Django now rejects GeoJSON CRS references to external resources in lookups, the GeometryField form field, and GEOSGeometry. Teams running GeoDjango can track SSRF fixes like this one on daily.dev before deploying to production."}},{"@type":"Question","name":"How do I protect Django's SpatialReference from SSRF via string input on GDAL?","acceptedAnswer":{"@type":"Answer","text":"Django's SpatialReference now disables network and file access when parsing string input on GDAL 3.9 or later, but full protection requires that GDAL version. On older GDAL versions, prefer integer SRIDs looked up directly in the EPSG database, or compare string input against an allow list; dictionary references using the DICT: or ESRI:: prefix are rejected on all GDAL versions. A new gis.W001 system check warns when GDAL is below 3.9. Developers patching GIS stacks can follow GDAL-related Django advisories like this on daily.dev."}},{"@type":"Question","name":"Can Django admin view-only users see password hashes for custom user models?","acceptedAnswer":{"@type":"Answer","text":"Yes, prior to CVE-2026-113733's fix, admin users with view (but not change) permission on a user model were shown the entire password hash when that model was not AUTH_USER_MODEL, or when AUTH_USER_MODEL inherited its password field from a concrete parent model via multi-table inheritance. This is fixed in Django 6.1.3, 6.0.10, and 5.2.19. Admin permission edge cases like this are easy to track down via daily.dev when auditing Django security releases."}}]}
```