Django 6.1.2

Overview

Released October 6, 2026. Django 6.1.2 is the second patch release in the 6.1 series. It resolves one security issue rated low severity, three rated moderate, and fixes an insufficient mitigation from an earlier advisory. The release also corrects a data loss issue dating back to Django 4.0, an infinite loop from 5.2, and several regressions introduced in 6.1.1.

Security Fixes

• CVE-2026-77050: Potential denial-of-service in get_supported_language_variant(). Language codes longer than 500 characters are now rejected or truncated before cached lookup.
• CVE-2026-84429: Quadratic-time parsing in parse_header_parameters(). Parsing now relies on Pythons email.message.Message, so some malformed RFC 2231 headers decode differently.
• CVE-2026-87890: Potential request forgery via spatial lookup byte values. Raster bytes must now be wrapped in GDALRaster, a backward incompatible change.
• CVE-2026-87975: Privilege abuse in model formsets with editable primary keys.

Bugfixes

• Fixed a class of bugs bypassing the depth limiter for deeply nested geometry collections (CVE-2026-15830).
• Fixed a data loss issue where network rasters were deleted by GeoDjango when closed.
• Fixed an infinite loop in TupleIn lookups when an F() expression is on the left-hand side.
• Fixed a regression allowing invalid srid=None geometry configurations to silently persist NULL.
• UUID4 values persisted as uppercase on Oracle are now fixed at their source.
• Corrected the fields.W225 system check warning on GeneratedField.
• Admin inline errors and delete screens now respect delete_confirmation_max_display set to 0.
• FETCH_PEERS now batches instances loaded by select_related().

Upgrade to Django 6.1.2

If you run Django 6.1, this is a recommended upgrade. Review the spatial lookup change for raster byte values before deploying, since it is backward incompatible. All other fixes are source compatible.