Newline Injection Vulnerability in Django Product by Django

CVE-2026-53878

What is CVE-2026-53878?

A vulnerability exists in Django's DomainNameValidator component that allows newlines in domain names. This can lead to potential header injection in HTTP responses if unfiltered values containing newlines are utilized. While the Django framework itself mitigates this risk via HttpResponse, which forbids newlines in HTTP headers, applications reliant on earlier Django versions (5.0.x, 4.1.x, and 3.2.x) might remain susceptible. Affected versions include Django 6.0 prior to 6.0.7 and 5.2 before 5.2.16. The discovery and reporting of this issue were credited to security researcher Bence Nagy.

References