Denial-of-service in Django `check_for_language()` (CVE-2026-15337)

`django.utils.translation.check_for_language()` was vulnerable to a denial-of-service attack when processing many distinct, very long language codes. Each code was stored as a key in an in-memory cache, consuming process memory. The language value is reachable via the `django.views.i18n.set_language()` view from POST data, though this view is not active by default. Affected versions: - Django main - Django 6.1 (currently at release candidate status) - Django 6.0 - Django 5.2 We recommend updating to: Django 6.0.8, Django 5.2.17. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/406 Details: https://vuln.today/cve/CVE-2026-15337