Bence Nagy

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.6 Django versions 5.2 through 5.2.15 **Description** An issue exists where `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object. This can lead to the disclosure of adjacent memory or cause service degradation through a potential segmentation fault—a specific type of error that occurs when a program attempts to access a memory location it is not allowed to access—when the `vsi buffer` property is accessed. **Recommendations** Update Django versions 6.0 through 6.0.6 to version 6.0.7. Update Django versions 5.2 through 5.2.15 to version 5.2.16.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 6.0.7 Django versions prior to 5.2.16 **Description** An issue exists where `DomainNameValidator` fails to prohibit newlines in domain names. While `CharField` strips newlines when used via a form field, other implementations may allow them. If an application incorporates these values containing newlines into an HTTP response, header injection can occur. Header injection is a technique used to insert malicious data into HTTP headers, potentially allowing attackers to manipulate the response sent to the client. **Recommendations** Update Django to version 6.0.7 or later. Update Django to version 5.2.16 or later.