Django 4.x — End of Life
EOL Critical riskDjango 4.x reached end of life on Apr 7, 2026, 199 days ago, and no longer receives security fixes. The most recent release in this series is 4.2.30. 20 CVEs are tracked for this series, including 1 critical. 8 of them were published after the end of life of the affected cycle and will not get an official patch. The next major version is Django 5. See Django 5 →
Django 4.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 4.2LTS | Apr 3, 2023 | Dec 4, 2023 | Apr 7, 2026 | 4.2.30 | EOL | |
| 4.1 | Aug 3, 2022 | Apr 5, 2023 | Dec 1, 2023 | 4.1.13 | EOL | |
| 4.0 | Dec 7, 2021 | Aug 3, 2022 | Apr 1, 2023 | 4.0.10 | EOL |
CVEs affecting Django 4.x (26)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-15830 | MEDIUM | 5.3 | 1.11% | — | 4.0 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeome… | Aug 4, 2026 |
| CVE-2026-15830 | MEDIUM | 5.3 | 1.11% | — | 4.1 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeome… | Aug 4, 2026 |
| CVE-2026-15830 | MEDIUM | 5.3 | 1.11% | — | 4.2 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeome… | Aug 4, 2026 |
| CVE-2026-15337 | MEDIUM | 5.3 | 0.59% | — | 4.1 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()… | Aug 4, 2026 |
| CVE-2026-15337 | MEDIUM | 5.3 | 0.59% | — | 4.2 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()… | Aug 4, 2026 |
| CVE-2026-15337 | MEDIUM | 5.3 | 0.59% | — | 4.0 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()… | Aug 4, 2026 |
| CVE-2026-15307 | HIGH | 8.8 | 1.13% | — | 4.1 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse… | Aug 4, 2026 |
| CVE-2026-15307 | HIGH | 8.8 | 1.13% | — | 4.0 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse… | Aug 4, 2026 |
| CVE-2026-15307 | HIGH | 8.8 | 1.13% | — | 4.2 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse… | Aug 4, 2026 |
| CVE-2026-4292 | LOW | 2.7 | 0.36% | — | 4.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `Mod… | Apr 7, 2026 |
| CVE-2026-4277 | CRITICAL | 9.8 | 0.60% | — | 4.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model i… | Apr 7, 2026 |
| CVE-2026-3902 | HIGH | 7.5 | 0.54% | — | 4.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote att… | Apr 7, 2026 |
| CVE-2026-33034 | HIGH | 7.5 | 0.85% | — | 4.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or u… | Apr 7, 2026 |
| CVE-2026-33033 | MEDIUM | 6.5 | 0.88% | — | 4.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote a… | Apr 7, 2026 |
| CVE-2026-25674 | LOW | 3.7 | 0.33% | — | 4.2 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system sto… | Mar 3, 2026 |
| CVE-2026-25673 | HIGH | 7.5 | 1.14% | — | 4.2 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django … | Mar 3, 2026 |
| CVE-2026-1312 | MEDIUM | 5.4 | 0.91% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject… | Feb 3, 2026 |
| CVE-2026-1287 | MEDIUM | 5.4 | 0.85% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to … | Feb 3, 2026 |
| CVE-2026-1285 | HIGH | 7.5 | 1.12% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.char… | Feb 3, 2026 |
| CVE-2026-1207 | MEDIUM | 5.4 | 12.81% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField``… | Feb 3, 2026 |
| CVE-2025-14550 | HIGH | 7.5 | 1.12% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote att… | Feb 3, 2026 |
| CVE-2025-13473 | MEDIUM | 5.3 | 0.81% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers… | Feb 3, 2026 |
| CVE-2025-64460 | HIGH | 7.5 | — | — | 4.2 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django… | Dec 2, 2025 |
| CVE-2025-13372 | MEDIUM | 4.3 | — | — | 4.2 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to … | Dec 2, 2025 |
| CVE-2025-59682 | LOW | 3.1 | 0.91% | — | 4.2 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.e… | Oct 1, 2025 |
| CVE-2025-59681 | HIGH | 7.1 | 0.62% | — | 4.2 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), Query… | Oct 1, 2025 |
Django 4.x is EOL — migrate to Django 5.x
Django 5.x is the next major release. Plan your upgrade before Django 4.x stops receiving security patches.
Add a Django 4 EOL badge to your README
Show your users which Django version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/django/4)Frequently asked questions
Is Django 4 end of life?
Yes. All Django 4.x releases have reached end of life and no longer receive security patches. There are 20 known CVEs affecting Django 4.x, including 1 critical. Migrate to Django 5.x as soon as possible.
What CVEs affect Django 4?
There are 20 CVEs tracked for Django 4.x, including 1 critical severity issue. See the full list above with CVSS and EPSS scores.
What is the latest Django 4 version?
The latest Django 4.x patch release is 4.2.30, released on April 7, 2026. Always run the latest patch to benefit from all security fixes.
How to migrate from Django 4 to Django 5?
To migrate from Django 4 to Django 5: (1) review the official Django 5 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Django 4 in production?
No. Django 4 has reached end of life and security vulnerabilities are no longer patched. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA