Django<=6.0.6: Header Injection via DomainNameValidator (newline)
CVE-2026-53878 Published on July 7, 2026
Header injection possibility since DomainNameValidator accepted newlines in input
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.
Timeline
Initial report received.
Vulnerability confirmed. 9 days later.
Security release issued. 26 days later.
Weakness Type
Improper Neutralization of Line Delimiters
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component. As data is parsed, an injected/absent/malformed delimiter may cause the process to take unexpected actions.
Products Associated with CVE-2026-53878
Want to know whenever a new CVE is published for Django Project Django? stack.watch will email you.
Affected Versions
djangoproject Django:- Version 6.0 and below 6.0.7 is affected.
- Version 6.0.7 is unaffected.
- Version 5.2 and below 5.2.16 is affected.
- Version 5.2.16 is unaffected.