CVE-2026-53878

score

0.1

cvss

6.1

epss

0.3%

published

2026-07-07

kev added

—

first seen

2026-10-21

Django 6.0 < 6.0.7 and 5.2 < 5.2.16 contain an HTTP header injection vulnerability caused by DomainNameValidator allowing newlines in domain names, letting attackers inject headers if values are used in HTTP responses, exploit requires application to use unvalidated domain names in headers.