{"id":"CVE-2026-53878","aliases":["GHSA-8qcx-xf44-272x","BIT-django-2026-53878","PYSEC-2026-2092"],"title":"Django: DomainNameValidator permits newline characters that may enable HTTP header injection","summary":"Django: DomainNameValidator permits newline characters that may enable HTTP header injection","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","vendor":"django","product":"django","ecosystem":"pip","affected":["django < 5.2.16","django >= 6.0.0, < 6.0.7"],"patched":["django 5.2.16","django 6.0.7"],"published":"2026-07-07","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:11.070082151Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8qcx-xf44-272x","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53878"},{"url":"https://github.com/django/django/commit/3a720d0d8bf2529253b98968f10ca73daf6d693c"},{"url":"https://github.com/django/django/commit/a5de13f1491f1dbf2bb0ad9b91570524ebbc8acd"},{"url":"https://github.com/django/django/commit/d5d60ed0323cddaa0ce0237a26a3d49ac21ee05e"},{"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"url":"https://github.com/django/django"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2092.yaml"},{"url":"https://groups.google.com/g/django-announce"},{"url":"https://www.djangoproject.com/weblog/2026/jul/07/security-releases"},{"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"url":"https://www.djangoproject.com/weblog/2026/jul/07/security-releases/"}],"tags":["osv","pip"],"epss":0.00327,"epssPercentile":0.25952,"ingestedAt":"2026-07-10T18:56:50.636Z","slug":"CVE-2026-53878","body":"## Overview\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy for reporting this issue.\n\n## Affected packages\n\n- `django < 5.2.16`\n- `django >= 6.0.0, < 6.0.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `django 5.2.16`\n- `django 6.0.7`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201759,"id":"CVE-2026-53878","ts":1789399675151,"field":"cvss","old":null,"new":"6.1"},{"seq":201758,"id":"CVE-2026-53878","ts":1789399675151,"field":"severity","old":"none","new":"medium"},{"seq":200489,"id":"CVE-2026-53878","ts":1789397340275,"field":"cvss","old":"6.1","new":null},{"seq":200488,"id":"CVE-2026-53878","ts":1789397340275,"field":"severity","old":"medium","new":"none"},{"seq":198406,"id":"CVE-2026-53878","ts":1789391901740,"field":"cvss","old":null,"new":"6.1"},{"seq":198405,"id":"CVE-2026-53878","ts":1789391901740,"field":"severity","old":"none","new":"medium"},{"seq":196200,"id":"CVE-2026-53878","ts":1789383547368,"field":"cvss","old":"6.1","new":null},{"seq":196199,"id":"CVE-2026-53878","ts":1789383547368,"field":"severity","old":"medium","new":"none"},{"seq":195129,"id":"CVE-2026-53878","ts":1789380424860,"field":"cvss","old":null,"new":"6.1"},{"seq":195128,"id":"CVE-2026-53878","ts":1789380424860,"field":"severity","old":"none","new":"medium"},{"seq":193916,"id":"CVE-2026-53878","ts":1789378442287,"field":"cvss","old":"6.1","new":null},{"seq":193915,"id":"CVE-2026-53878","ts":1789378442287,"field":"severity","old":"medium","new":"none"},{"seq":192703,"id":"CVE-2026-53878","ts":1789376374921,"field":"cvss","old":null,"new":"6.1"},{"seq":192702,"id":"CVE-2026-53878","ts":1789376374921,"field":"severity","old":"none","new":"medium"},{"seq":191490,"id":"CVE-2026-53878","ts":1789373352288,"field":"cvss","old":"6.1","new":null},{"seq":191489,"id":"CVE-2026-53878","ts":1789373352288,"field":"severity","old":"medium","new":"none"},{"seq":190275,"id":"CVE-2026-53878","ts":1789369259595,"field":"cvss","old":null,"new":"6.1"},{"seq":190274,"id":"CVE-2026-53878","ts":1789369259595,"field":"severity","old":"none","new":"medium"},{"seq":189062,"id":"CVE-2026-53878","ts":1789368226484,"field":"cvss","old":"6.1","new":null},{"seq":189061,"id":"CVE-2026-53878","ts":1789368226484,"field":"severity","old":"medium","new":"none"},{"seq":187845,"id":"CVE-2026-53878","ts":1789365117406,"field":"cvss","old":null,"new":"6.1"},{"seq":187844,"id":"CVE-2026-53878","ts":1789365117406,"field":"severity","old":"none","new":"medium"},{"seq":186632,"id":"CVE-2026-53878","ts":1789363220069,"field":"cvss","old":"6.1","new":null},{"seq":186631,"id":"CVE-2026-53878","ts":1789363220069,"field":"severity","old":"medium","new":"none"},{"seq":185418,"id":"CVE-2026-53878","ts":1789361064629,"field":"cvss","old":null,"new":"6.1"},{"seq":185417,"id":"CVE-2026-53878","ts":1789361064629,"field":"severity","old":"none","new":"medium"},{"seq":184205,"id":"CVE-2026-53878","ts":1789358098523,"field":"cvss","old":"6.1","new":null},{"seq":184204,"id":"CVE-2026-53878","ts":1789358098523,"field":"severity","old":"medium","new":"none"},{"seq":182456,"id":"CVE-2026-53878","ts":1789354192392,"field":"cvss","old":null,"new":"6.1"},{"seq":182455,"id":"CVE-2026-53878","ts":1789354192392,"field":"severity","old":"none","new":"medium"},{"seq":181249,"id":"CVE-2026-53878","ts":1789353080800,"field":"cvss","old":"6.1","new":null},{"seq":181248,"id":"CVE-2026-53878","ts":1789353080800,"field":"severity","old":"medium","new":"none"},{"seq":180042,"id":"CVE-2026-53878","ts":1789350136076,"field":"cvss","old":null,"new":"6.1"},{"seq":180041,"id":"CVE-2026-53878","ts":1789350136076,"field":"severity","old":"none","new":"medium"},{"seq":178835,"id":"CVE-2026-53878","ts":1789348044892,"field":"cvss","old":"6.1","new":null},{"seq":178834,"id":"CVE-2026-53878","ts":1789348044892,"field":"severity","old":"medium","new":"none"},{"seq":177628,"id":"CVE-2026-53878","ts":1789346253372,"field":"cvss","old":null,"new":"6.1"},{"seq":177627,"id":"CVE-2026-53878","ts":1789346253372,"field":"severity","old":"none","new":"medium"},{"seq":176421,"id":"CVE-2026-53878","ts":1789342967901,"field":"cvss","old":"6.1","new":null},{"seq":176420,"id":"CVE-2026-53878","ts":1789342967901,"field":"severity","old":"medium","new":"none"},{"seq":174538,"id":"CVE-2026-53878","ts":1789334731323,"field":"cvss","old":null,"new":"6.1"},{"seq":174537,"id":"CVE-2026-53878","ts":1789334731323,"field":"severity","old":"none","new":"medium"},{"seq":173333,"id":"CVE-2026-53878","ts":1789333449294,"field":"cvss","old":"6.1","new":null},{"seq":173332,"id":"CVE-2026-53878","ts":1789333449294,"field":"severity","old":"medium","new":"none"},{"seq":172147,"id":"CVE-2026-53878","ts":1789330971448,"field":"cvss","old":null,"new":"6.1"},{"seq":172146,"id":"CVE-2026-53878","ts":1789330971448,"field":"severity","old":"none","new":"medium"},{"seq":170961,"id":"CVE-2026-53878","ts":1789328556189,"field":"cvss","old":"6.1","new":null},{"seq":170960,"id":"CVE-2026-53878","ts":1789328556189,"field":"severity","old":"medium","new":"none"},{"seq":169756,"id":"CVE-2026-53878","ts":1789327036159,"field":"cvss","old":null,"new":"6.1"},{"seq":169755,"id":"CVE-2026-53878","ts":1789327036159,"field":"severity","old":"none","new":"medium"}]}