CVE-2026-53878

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. DomainNameValidator does not prohibit newlines in domain names (unless used via a form field, since CharField strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. DomainNameValidator does not prohibit newlines in domain names (unless used via a form field, since CharField strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. DomainNameValidator does not prohibit newlines in domain names (unless used via a form field, since CharField strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. DomainNameValidator does not prohibit newlines in domain names (unless used via a form field, since CharField strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. DomainNameValidator does not prohibit newlines in domain names (unless used via a form field, since CharField strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.9.post3+tuxcare.

TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.4.post3+tuxcare.

TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.post5+tuxcare.

TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.10.post7+tuxcare.

The updated package fixes security vulnerabilities: Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie. (CVE-2026-6873) Potential unencrypted email transmission via STARTTLS in the SMTP backend. (CVE-2026-7666) Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware. (CVE-2026-8404) Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware. (CVE-2026-35193) Potential exposure of private data via whitespace padding in Vary header. (CVE-2026-48587) Potential exposure of private data via cached Set-Cookie response. (CVE-2026-48588) Heap buffer over-read in GDALRaster. (CVE-2026-53877) Header injection possibility since DomainNameValidator accepted newlines in input. (CVE-2026-53878)

These are all security issues fixed in the python313-Django6-6.0.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-Django fixes the following issues:

Changes in python-Django:

• CVE-2026-48588: Potential exposure of private data via cached Set-Cookie response (bsc#1271029)
• CVE-2026-53877: Heap buffer over-read in GDALRaster (bsc#1271030)
• CVE-2026-53878: Header injection possibility since DomainNameValidator accepted newlines in input (bsc#1271031)