Input validation error in Django - CVE-2026-53878
Published: July 7, 2026
Vulnerability identifier: #VU137030
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53878
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject HTTP headers.
The vulnerability exists due to improper input validation in django.core.validators.DomainNameValidator when validating domain names containing newline characters. A remote user can supply a domain name containing newlines to inject HTTP headers.
The issue only affects uses of DomainNameValidator outside Django form fields, as CharField strips newlines by default. Django's HttpResponse itself prohibits newlines in HTTP headers.
Affected software
Django
Fedora
python-django5
Fedora
python-django5
How to mitigate CVE-2026-53878
Install security update from vendor's website.
Django - addressed in versions 5.2.16, 6.0.7
python-django5 - addressed in versions 5.2.16-1.fc43, 5.2.16-1.fc44
python-django5 - addressed in versions 5.2.16-1.fc43, 5.2.16-1.fc44