Django 4.x — End of Life
EOL Critical riskDjango 4.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 4.2LTS | Apr 3, 2023 | Dec 4, 2023 | Apr 7, 2026 | 4.2.30 | EOL | |
| 4.1 | Aug 3, 2022 | Apr 5, 2023 | Dec 1, 2023 | 4.1.13 | EOL | |
| 4.0 | Dec 7, 2021 | Aug 3, 2022 | Apr 1, 2023 | 4.0.10 | EOL |
CVEs affecting Django 4.x (13)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-4292 | LOW | 2.7 | 0.29% | — | 4.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `Mod… | Apr 7, 2026 |
| CVE-2026-4277 | CRITICAL | 9.8 | 0.46% | — | 4.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model i… | Apr 7, 2026 |
| CVE-2026-3902 | HIGH | 7.5 | 0.44% | — | 4.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote att… | Apr 7, 2026 |
| CVE-2026-33034 | HIGH | 7.5 | 0.77% | — | 4.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or u… | Apr 7, 2026 |
| CVE-2026-33033 | MEDIUM | 6.5 | 0.88% | — | 4.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote a… | Apr 7, 2026 |
| CVE-2026-25674 | LOW | 3.7 | 0.34% | — | 4.2 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system sto… | Mar 3, 2026 |
| CVE-2026-25673 | HIGH | 7.5 | 0.73% | — | 4.2 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django … | Mar 3, 2026 |
| CVE-2026-1312 | MEDIUM | 5.4 | 0.80% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject… | Feb 3, 2026 |
| CVE-2026-1287 | MEDIUM | 5.4 | 0.75% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to … | Feb 3, 2026 |
| CVE-2026-1285 | HIGH | 7.5 | 0.99% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.char… | Feb 3, 2026 |
| CVE-2026-1207 | MEDIUM | 5.4 | 12.98% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField``… | Feb 3, 2026 |
| CVE-2025-14550 | HIGH | 7.5 | 0.99% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote att… | Feb 3, 2026 |
| CVE-2025-13473 | MEDIUM | 5.3 | 0.71% | — | 4.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers… | Feb 3, 2026 |
Django 4.x is EOL — migrate to Django 5.x
Django 5.x is the next major release. Plan your upgrade before Django 4.x stops receiving security patches.
Frequently asked questions
Is Django 4 end of life?
Yes. All Django 4.x releases have reached end of life and no longer receive security patches. There are 13 known CVEs affecting Django 4.x, including 1 critical. Migrate to Django 5.x as soon as possible.
What CVEs affect Django 4?
There are 13 CVEs tracked for Django 4.x, including 1 critical severity issue. See the full list above with CVSS and EPSS scores.
What is the latest Django 4 version?
The latest Django 4.x patch release is 4.2.30, released on April 7, 2026. Always run the latest patch to benefit from all security fixes.
How to migrate from Django 4 to Django 5?
To migrate from Django 4 to Django 5: (1) review the official Django 5 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Django 4 in production?
No. Django 4 has reached end of life and security vulnerabilities are no longer patched. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA