Critical Django Flaw Allows DoS and SQL Injection Attacks

The Django Software Foundation issued emergency security releases (4.2.28, 5.2.11, 6.0.2) on 2026-02-03 fixing six vulnerabilities: three high-severity SQL injection flaws impacting PostGIS raster lookups, FilteredRelation column aliases, and QuerySet.order_by(), two moderate denial-of-service issues (including ASGI duplicate header processing and HTML truncation), and one low-severity username enumeration; administrators should upgrade immediately and ensure untrusted input is properly sanitized.