openSUSE Patches Four Django Flaws Affecting Leap 16 Web Application Servers
openSUSE has published security update openSUSE-SU-2026:22196-1, which the project rates as critical, covering four vulnerabilities in the python-Django package shipped with openSUSE Leap 16.0. The flaws are tracked as CVE-2026-77050, CVE-2026-84429, CVE-2026-87890 and CVE-2026-87975, with SUSE-assigned CVSS v3.1 scores ranging from 4.3 to 5.3; CVE-2026-77050 additionally carries a CVSS v4.0 score of 6.9. The update also closes four associated bug reports (bsc#1284471, bsc#1284472, bsc#1284476 and bsc#1284481) and delivers the corrected package python313-Django-5.2.4-bp160.12.1. Any organisation running Django web applications on Leap 16.0 from the PackageHub repository is in scope.
The advisory describes each weakness in terms of its triggering condition. CVE-2026-87975 allows an authenticated user who may submit a formset to mark a row outside the limiting queryset for deletion, even without permission on the targeted object. CVE-2026-87890 is an incomplete fix for CVE-2026-15307 in Django spatial lookups, where an attacker able to supply bytes values can cause the Django process itself to issue network requests through a crafted VRT document. The remaining two are resource-exhaustion issues: CVE-2026-84429 stems from quadratic time complexity when parsing a value containing many separators inside a quoted parameter, while CVE-2026-77050 affects get_supported_language_variant() when it processes many distinct, very long language codes. No proof-of-concept code or exploitation detail beyond these descriptions has been published by the vendor.
The practical exposure sits with internet-facing Django deployments, since the two denial-of-service conditions are reachable over the network without credentials or user interaction according to their CVSS vectors. The spatial lookup flaw is notable because it turns the application server into the originator of outbound requests, a behaviour that can be used to probe internal infrastructure, while the formset issue erodes the integrity of object-level authorisation for users who already hold a login. Current exploitation signals remain low: FIRST EPSS places the 30-day exploitation probability at 0.5% for CVE-2026-77050 and CVE-2026-84429, 0.3% for CVE-2026-87890, 0.2% for CVE-2026-87975, and 1.1% for the earlier CVE-2026-15307. No in-the-wild activity is reported in the advisory.
Attack Surface
Web Application, Server OS
Tactics
Impact, Initial Access, Privilege Escalation
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
- T1068 – Exploitation for Privilege Escalation
SuperPRO's Threat Countermeasures Procedures
- Install the fixed package python313-Django-5.2.4-bp160.12.1 on all openSUSE Leap 16.0 hosts by running 'zypper in -t patch openSUSE-Leap-16.0-packagehub-704=1', or apply it through YaST online_update or 'zypper patch'.
- Inventory Leap 16.0 systems with 'rpm -q python313-Django' to identify builds older than 5.2.4-bp160.12.1, and prioritise any host whose Django application is reachable from the internet.
- Until the package is updated, rate-limit or cap the length of the Accept-Language header at the reverse proxy or load balancer, since CVE-2026-77050 is triggered by many distinct, very long language codes reaching get_supported_language_variant().
- Restrict or disable Django spatial lookups (GeoDjango queries) that accept user-supplied bytes values, and block outbound traffic from the application server to untrusted destinations so a crafted VRT document under CVE-2026-87890 cannot complete a network request.
- Review Django admin and custom formset views that permit deletion, and enforce object-level permission checks against the limiting queryset in the form or view layer to contain CVE-2026-87975 abuse by authenticated users.
- Alert on sustained high CPU on Django worker processes or WSGI/ASGI request timeouts coinciding with requests carrying many separators inside quoted header parameters, which is the parsing pattern behind the quadratic-complexity issue in CVE-2026-84429.
- Track SUSE bug references bsc#1284471, bsc#1284472, bsc#1284476 and bsc#1284481 in the patch management record so the four fixes are verified as deployed rather than assumed.
