CVE-2026-53878

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.0.7 Django versions prior to 5.2.16

Description An issue exists where DomainNameValidator fails to prohibit newlines in domain names. While CharField strips newlines when used via a form field, other implementations may allow them. If an application incorporates these values containing newlines into an HTTP response, header injection can occur. Header injection is a technique used to insert malicious data into HTTP headers, potentially allowing attackers to manipulate the response sent to the client.

Recommendations Update Django to version 6.0.7 or later. Update Django to version 5.2.16 or later.