Django 5.x — End of Life
Active Critical risk EOL: Apr 30, 2028in 554d3 releases in this series32 CVEs
Django 5.x is partially supported: only 5.2 still receives security fixes until Apr 30, 2028, in 554 days. The most recent release in this series is 5.2.18. 32 CVEs are tracked for this series, including 1 critical. 3 of them were published after the end of life of the affected cycle and will not get an official patch. The next major version is Django 6. See Django 6 →
Django 5.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 5.2LTS | Apr 2, 2025 | Dec 3, 2025 | Apr 30, 2028 | 5.2.18 | Active | |
| 5.1 | Aug 7, 2024 | Apr 2, 2025 | Dec 3, 2025 | 5.1.15 | EOL | |
| 5.0 | Dec 4, 2023 | Aug 7, 2024 | Apr 2, 2025 | 5.0.14 | EOL |
CVEs affecting Django 5.x (42)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-15920 | MEDIUM | 6.1 | 0.35% | — | 5.2 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field(… | Aug 4, 2026 |
| CVE-2026-15830 | MEDIUM | 5.3 | 1.11% | — | 5.2 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeome… | Aug 4, 2026 |
| CVE-2026-15830 | MEDIUM | 5.3 | 1.11% | — | 5.0 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeome… | Aug 4, 2026 |
| CVE-2026-15830 | MEDIUM | 5.3 | 1.11% | — | 5.1 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeome… | Aug 4, 2026 |
| CVE-2026-15337 | MEDIUM | 5.3 | 0.59% | — | 5.2 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()… | Aug 4, 2026 |
| CVE-2026-15337 | MEDIUM | 5.3 | 0.59% | — | 5.0 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()… | Aug 4, 2026 |
| CVE-2026-15337 | MEDIUM | 5.3 | 0.59% | — | 5.1 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()… | Aug 4, 2026 |
| CVE-2026-15307 | HIGH | 8.8 | 1.13% | — | 5.1 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse… | Aug 4, 2026 |
| CVE-2026-15307 | HIGH | 8.8 | 1.13% | — | 5.0 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse… | Aug 4, 2026 |
| CVE-2026-15307 | HIGH | 8.8 | 1.13% | — | 5.2 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse… | Aug 4, 2026 |
| CVE-2026-53878 | MEDIUM | 6.1 | 0.32% | — | 5.2 | An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlin… | Jul 7, 2026 |
| CVE-2026-53877 | MEDIUM | 4.8 | 0.52% | — | 5.2 | An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-read… | Jul 7, 2026 |
| CVE-2026-48588 | LOW | 3.1 | 0.42% | — | 5.2 | An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()`… | Jul 7, 2026 |
| CVE-2026-8404 | LOW | 3.1 | 0.42% | — | 5.2 | An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware… | Jun 3, 2026 |
| CVE-2026-7666 | LOW | 3.1 | 0.20% | — | 5.2 | An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` … | Jun 3, 2026 |
| CVE-2026-6873 | LOW | 3.1 | 0.28% | — | 5.2 | An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in… | Jun 3, 2026 |
| CVE-2026-48587 | LOW | 3.1 | 0.42% | — | 5.2 | An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Djan… | Jun 3, 2026 |
| CVE-2026-35193 | LOW | 3.1 | 0.43% | — | 5.2 | An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware… | Jun 3, 2026 |
| CVE-2026-6907 | MEDIUM | 4.3 | 0.43% | — | 5.2 | An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erron… | May 5, 2026 |
| CVE-2026-5766 | MEDIUM | 5.3 | 0.51% | — | 5.2 | An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-… | May 5, 2026 |
| CVE-2026-35192 | MEDIUM | 6.5 | 0.68% | — | 5.2 | An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session … | May 5, 2026 |
| CVE-2026-4292 | LOW | 2.7 | 0.36% | — | 5.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `Mod… | Apr 7, 2026 |
| CVE-2026-4277 | CRITICAL | 9.8 | 0.60% | — | 5.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model i… | Apr 7, 2026 |
| CVE-2026-3902 | HIGH | 7.5 | 0.54% | — | 5.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote att… | Apr 7, 2026 |
| CVE-2026-33034 | HIGH | 7.5 | 0.85% | — | 5.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or u… | Apr 7, 2026 |
| CVE-2026-33033 | MEDIUM | 6.5 | 0.88% | — | 5.2 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote a… | Apr 7, 2026 |
| CVE-2026-25674 | LOW | 3.7 | 0.33% | — | 5.2 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system sto… | Mar 3, 2026 |
| CVE-2026-25673 | HIGH | 7.5 | 1.14% | — | 5.2 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django … | Mar 3, 2026 |
| CVE-2026-1312 | MEDIUM | 5.4 | 0.91% | — | 5.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject… | Feb 3, 2026 |
| CVE-2026-1287 | MEDIUM | 5.4 | 0.85% | — | 5.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to … | Feb 3, 2026 |
| CVE-2026-1285 | HIGH | 7.5 | 1.12% | — | 5.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.char… | Feb 3, 2026 |
| CVE-2026-1207 | MEDIUM | 5.4 | 12.81% | — | 5.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField``… | Feb 3, 2026 |
| CVE-2025-14550 | HIGH | 7.5 | 1.12% | — | 5.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote att… | Feb 3, 2026 |
| CVE-2025-13473 | MEDIUM | 5.3 | 0.81% | — | 5.2 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers… | Feb 3, 2026 |
| CVE-2025-64460 | HIGH | 7.5 | — | — | 5.1 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django… | Dec 2, 2025 |
| CVE-2025-64460 | HIGH | 7.5 | — | — | 5.2 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django… | Dec 2, 2025 |
| CVE-2025-13372 | MEDIUM | 4.3 | — | — | 5.2 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to … | Dec 2, 2025 |
| CVE-2025-13372 | MEDIUM | 4.3 | — | — | 5.1 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to … | Dec 2, 2025 |
| CVE-2025-59682 | LOW | 3.1 | 0.91% | — | 5.1 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.e… | Oct 1, 2025 |
| CVE-2025-59682 | LOW | 3.1 | 0.91% | — | 5.2 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.e… | Oct 1, 2025 |
| CVE-2025-59681 | HIGH | 7.1 | 0.62% | — | 5.2 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), Query… | Oct 1, 2025 |
| CVE-2025-59681 | HIGH | 7.1 | 0.62% | — | 5.1 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), Query… | Oct 1, 2025 |
Django 5.x will reach end of life — migrate to Django 6.x
Django 6.x is the next major release. Plan your upgrade before Django 5.x stops receiving security patches.
Add a Django 5 EOL badge to your README
Show your users which Django version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/django/5)Frequently asked questions
Is Django 5 end of life?
Partially. 2 of the 3 Django 5.x releases have reached end of life. Still supported: 5.2 (until April 30, 2028 at the latest).
What CVEs affect Django 5?
There are 32 CVEs tracked for Django 5.x, including 1 critical severity issue. See the full list above with CVSS and EPSS scores.
What is the latest Django 5 version?
The latest Django 5.x patch release is 5.2.18, released on October 6, 2026. Always run the latest patch to benefit from all security fixes.
How to migrate from Django 5 to Django 6?
To migrate from Django 5 to Django 6: (1) review the official Django 6 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Django 5 in production?
Only on a supported release (5.2). Support for Django 5.2 ends on April 30, 2028. Make sure you run the latest patch (5.2.18) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA