Jacob Walls

Header injection possibility since DomainNameValidator accepted newlines in input

Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass

Privilege abuse in ModelAdmin.list_editable

Privilege abuse in GenericInlineModelAdmin

ASGI header spoofing via underscore/hyphen conflation

Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass

Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows