CVE-2026-53878

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

Scoring

Severity

MEDIUM

CVSS base score

6.1

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS probability

0.33%

CWE

CWE-144

Published

2026-07-07

Last modified

2026-07-08

Affected products

• djangoproject Django
• djangoproject Django
• djangoproject Django
• djangoproject Django

Weakness type

• CWE-144

Related vulnerabilities

• CVE-2025-24367 — Cacti allows Arbitrary File Creation leading to RCE
• CVE-2023-39212

Markdown version · Browse all CVEs