CVE-2019-12781: An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3.

Security readout for executives and security teams

This Django flaw can cause an HTTP request to be treated incorrectly when Django sits behind a reverse proxy and specific HTTPS-related settings are enabled. The business risk is failed HTTPS enforcement, not remote code execution. Affected applications should be updated because the intended redirect to HTTPS may not happen in the documented deployment pattern. Exposure is limited to Django applications on the affected versions using the specified SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT configuration behind a reverse proxy that connects to Django via HTTPS. Applications not using this deployment pattern are less likely to be affected based on the provided sources. Treat this as a targeted web hardening issue. Prioritize public-facing Django services where HTTPS enforcement is part of compliance, customer trust, or session protection. It is not evidenced as actively exploited in the supplied sources, but the fix is straightforward and should be scheduled promptly. Mitigation focus: Upgrade Django to 1.11.22, 2.1.10, 2.2.3, or later supported releases.; Apply operating-system vendor packages from Debian, Ubuntu, Fedora, or SUSE where applicable.; Inventory Django deployments using SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT behind reverse proxies..

Prepared

Jun 6, 2026, 20:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.