CVE-2015-5144: Django - HTTP Response Splitting Vulnerability
Summary
CVE-2015-5144: Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting at... Affects django across 3 version ranges.
< 1.4.21
>= 1.5, < 1.7.9
>= 1.8, < 1.8.3
Fixed in 1.4.21, 1.7.9 or 1.8.3, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2015-5144 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It offers features such as URL routing, database abstraction, template rendering, and user authentication. Django is widely used in the development of secure and scalable web applications.
Vulnerability Detail
The vulnerability, identified as CVE-2015-5144, exists in versions of Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3. It stems from an incorrect regular expression used by Django, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks. This can be achieved by exploiting a newline character in an email message to the EmailValidator, a URL to the URLValidator, or through unspecified vectors to the validate_ipv4_address or validate_slug validator. Successful exploitation of this vulnerability can lead to various security issues, including cross-site scripting (XSS) attacks, session hijacking, and information disclosure.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.4.211.4.21pip install --upgrade "django==1.4.21" -
>= 1.5, < 1.7.91.7.9pip install --upgrade "django==1.7.9" -
>= 1.8, < 1.8.31.8.3pip install --upgrade "django==1.8.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually validate and sanitize user input to prevent the injection of newline characters that could be used for HTTP response splitting attacks. This can be achieved by implementing input validation and sanitization routines in the application code. Here is an example of how to sanitize user input in Python:
import re
def sanitize_input(input_string):
sanitized_string = re.sub(r'[
]', '', input_string)
return sanitized_string
By using the sanitize_input function to sanitize user input before processing it, the risk of HTTP response splitting can be mitigated.
Conclusion
The Django HTTP response splitting vulnerability (CVE-2015-5144) poses a significant security risk to web applications built using vulnerable versions of Django. It allows remote attackers to inject arbitrary headers and conduct various attacks, including cross-site scripting (XSS) and session hijacking. To mitigate this vulnerability, it is crucial to upgrade Django to the recommended fixed versions and implement input validation and sanitization routines. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that provides a set of tools and libraries for building web applications. It simplifies the development process by offering features such as URL routing, database abstraction, template rendering, and user authentication.
HTTP response splitting is a web application vulnerability that allows an attacker to inject arbitrary headers into an HTTP response. This can lead to various security issues, including cross-site scripting (XSS) attacks, session hijacking, and information disclosure.
The Django HTTP response splitting vulnerability can be exploited by injecting a newline character in an email message to the EmailValidator, a URL to the URLValidator, or through unspecified vectors to the validate_ipv4_address or validate_slug validator. This allows remote attackers to inject arbitrary headers into the HTTP response.
The potential consequences of the Django HTTP response splitting vulnerability include cross-site scripting (XSS) attacks, session hijacking, and information disclosure. By injecting arbitrary headers into the HTTP response, an attacker can manipulate the behavior of the web application and potentially compromise user data.
To mitigate the Django HTTP response splitting vulnerability, it is recommended to upgrade Django to version 1.4.21, 1.7.9, or 1.8.3, depending on the currently installed version. Additionally, developers can implement input validation and sanitization routines to prevent the injection of newline characters that could be used for HTTP response splitting attacks.
Related vulnerabilities
Recent vulnerabilities recorded for django.
