{
  "cveId": "CVE-2026-53878",
  "url": "https://patchblox.com/security/cve/CVE-2026-53878",
  "summary": "CVE-2026-53878 is fixed in 2 products on 1 platform, first by OPENSUSE-SU-2026:21313-1, released July 10, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python-django: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16",
  "description": "An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. \u0060DomainNameValidator\u0060 does not prohibit newlines in domain names (unless used via a form field, since \u0060CharField\u0060 strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because \u0060HttpResponse\u0060 prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.",
  "published": "2026-07-07T15:16:48Z",
  "severity": "",
  "epss": 0.00327,
  "epssPercentile": 0.25955,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "5.2.4-bp160.10.1",
      "fix": "OPENSUSE-SU-2026:21313-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21313-1",
      "released": "2026-07-10T11:01:40Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 14",
      "fixedVersion": "3:5.2.16-1",
      "fix": "DEBIAN-CVE-2026-53878",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-53878",
      "released": "2026-07-10T15:54:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}