CVE-2026-53878: Django DomainNameValidator Allows Newline Characters Leading to HTTP Header Injection
Summary
CVE-2026-53878: Django: DomainNameValidator permits newline characters that may enable HTTP header injection. Affects django across 2 version ranges.
< 5.2.16
>= 6.0.0, < 6.0.7
Fixed in 5.2.16 or 6.0.7, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2026-53878 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and templating. However, certain versions of Django are vulnerable to an issue in the DomainNameValidator, which fails to adequately restrict newline characters in domain names, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from the DomainNameValidator in Django versions 6.0 before 6.0.7 and 5.2 before 5.2.16, which does not prohibit newline characters in domain names. This oversight can lead to HTTP header injection if an application uses these values in HTTP responses. While Django's HttpResponse class mitigates this risk by prohibiting newlines in HTTP headers, applications that do not utilize this feature may be at risk. Unsupported versions of Django, such as 5.0.x, 4.1.x, and 3.2.x, may also be affected but have not been evaluated.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.2.165.2.16pip install --upgrade "django==5.2.16" -
>= 6.0.0, < 6.0.76.0.7pip install --upgrade "django==6.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to implement custom validation logic that strips newline characters from domain names before they are processed. This can be done by overriding the validation method in your forms or models, ensuring that any input is sanitized before being used in HTTP responses.
Conclusion
In summary, the vulnerability identified as CVE-2026-53878 in Django's DomainNameValidator allows newline characters, which can lead to HTTP header injection. It is crucial to update to the latest patched versions of Django to mitigate this risk. If immediate updates are not possible, implementing custom validation logic can serve as a temporary solution.
See every vulnerability recorded for django →
FAQ
The vulnerability can lead to HTTP header injection, which may allow attackers to manipulate HTTP responses and potentially execute malicious actions.
Django versions 6.0 before 6.0.7 and 5.2 before 5.2.16 are affected. Unsupported versions like 5.0.x, 4.1.x, and 3.2.x may also be vulnerable.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Implement a custom validation logic to strip newline characters from domain names as a temporary workaround until you can upgrade.
The CVSS score of this vulnerability is 6.1, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
