Header injection possibility since DomainNameValidator accepted newlines in input
Summary
| CVE | CVE-2026-53878 |
|---|---|
| State | PUBLISHED |
| Assigner | DSF |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-07 15:16:48 UTC |
| Updated | 2026-07-07 16:16:40 UTC |
| Description | An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue. |
Risk And Classification
Primary CVSS: v4.0 5.3 MEDIUM from 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-144 | CWE-144 CWE-144: Improper Neutralization of Line Delimiters
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | Secondary | 5.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 5.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| 3.1 | 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | Secondary | 6.1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| 3.1 | CNA | DECLARED | 6.1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
PassiveConfidentiality
NoneIntegrity
NoneAvailability
NoneSub Conf.
LowSub Integrity
LowSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
ChangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Djangoproject | Django | affected 6.0 6.0.7 python | Not specified |
| CNA | Djangoproject | Django | unaffected 6.0.7 python | Not specified |
| CNA | Djangoproject | Django | affected 5.2 5.2.16 python | Not specified |
| CNA | Djangoproject | Django | unaffected 5.2.16 python | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| groups.google.com/g/django-announce | 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | groups.google.com | |
| docs.djangoproject.com/en/dev/releases/security | 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | docs.djangoproject.com | |
| www.djangoproject.com/weblog/2026/jul/07/security-releases | 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | www.djangoproject.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Bence Nagy (en)
CNA: Natalia Bidart (en)
CNA: Jacob Walls (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-06-02T12:00:00.000Z | Initial report received. |
| CNA | 2026-06-11T12:00:00.000Z | Vulnerability confirmed. |
| CNA | 2026-07-07T09:00:00.000Z | Security release issued. |
There are currently no legacy QID mappings associated with this CVE.