Potential request forgery via spatial lookup byte values

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-87890 · Microsoft / collected KEV context

cve-program · CVE-2026-87890

• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• https://github.com/django/django/commit/ebcb13b327301f28cbc6cd5e4988a719f00575aa
• https://github.com/django/django/commit/4e77ef1e69c94780006b82795aa7db101996c3af
• https://github.com/django/django/commit/a2347fe8234a1831d56c875acc0ea51e0742957c
• https://github.com/django/django/commit/dd0558d1617619e0d66163675ef02135d0f54e5f
• https://www.djangoproject.com/weblog/2026/oct/06/security-releases/

No related operational record is retained in the current change model.