Django security releases issued: 6.0.4, 5.2.13, and 4.2.30

Django has issued security releases 6.0.4, 5.2.13, and 4.2.30 addressing five CVEs. The vulnerabilities include ASGI header spoofing via underscore/hyphen conflation (CVE-2026-3902), privilege abuse in GenericInlineModelAdmin (CVE-2026-4277) and ModelAdmin.list_editable (CVE-2026-4292) via forged POST data, a DoS in MultiPartParser via base64-encoded uploads with excessive whitespace (CVE-2026-33033, severity moderate), and a DoS in ASGI requests via memory upload limit bypass (CVE-2026-33034). All issues are rated low severity except the MultiPartParser DoS which is moderate. Additionally, Django 4.2 has reached end of extended support, and users are urged to upgrade to 5.2 or later.