{"id":"CVE-2021-32052","aliases":["BIT-django-2021-32052","DEBIAN-CVE-2021-32052","EUVD-2021-0065","GHSA-qm57-vhq3-3fwf","MGASA-2021-0356","PYSEC-2021-8","UBUNTU-CVE-2021-32052","USN-4975-1","USN-5373-1","USN-5373-2","openSUSE-SU-2023:0005-1","openSUSE-SU-2024:11205-1","openSUSE-SU-2024:13887-1","openSUSE-SU-2024:14208-1","openSUSE-SU-2026:10005-1","openSUSE-SU-2026:11235-1","openSUSE-SU-2026:11248-1","openSUSE-SU-2026:11270-1"],"status":"published","title":"Header injection possible in Django","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03172,"percentile":0.88126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-88"],"published":"2021-05-06T15:49:20Z","modified":"2026-10-24T10:30:33Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["2.2.22","3.1.10","3.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["2.2.22","3.1.10","3.2.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["2:2.2.22-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["2:2.2.22-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["2:2.2.22-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-django","fixed_in":["1:1.11.11-1ubuntu1.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"python-django","fixed_in":["2:2.2.12-1ubuntu0.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"},{"fixed":"2.2.22"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1"},{"fixed":"3.1.10"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2"},{"fixed":"3.2.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.22"},{"introduced":"3.1.0"},{"fixed":"3.1.10"},{"introduced":"3.2.0"},{"fixed":"3.2.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.22-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.22-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.22-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"},{"fixed":"2.2.22"}]}],"versions":["2.2","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.21","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1"},{"fixed":"3.1.10"}]}],"versions":["3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2"},{"fixed":"3.2.2"}]}],"versions":["3.2","3.2.1"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-1.mga8"}]}],"bundled":6},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"},{"fixed":"2.2.22"},{"introduced":"3.1"},{"fixed":"3.1.10"},{"introduced":"3.2"},{"fixed":"3.2.2"}]}],"versions":["2.2","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.20","2.2.21","3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2","3.2.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.17"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.7"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.14"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.7"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.17"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.11"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-0ubuntu1.3+esm5"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.15+esm5"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13","1.8.7-1ubuntu5.14","1.8.7-1ubuntu5.15","1.8.7-1ubuntu5.15+esm1","1.8.7-1ubuntu5.15+esm3","1.8.7-1ubuntu5.15+esm4"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.28-bp153.2.3.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.28-bp153.2.3.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-2.3"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-2.1"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.14-1.1"}]}],"bundled":51},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-1.1"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-4.1"}]}],"bundled":59},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":49},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93}],"products":[{"vendor":"djangoproject","product":"django"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://docs.djangoproject.com/en/3.2/releases/security/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2021/05/06/1","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://www.djangoproject.com/weblog/2021/may/06/security-releases/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix","web","article","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210611-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32052","tags":["web","advisory"]},{"url":"https://github.com/django/django/commit/e1e81aa1c4427411e3c68facdd761229ffea6f6f","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944801","tags":["web"]},{"url":"https://groups.google.com/forum/#!forum/django-announce","tags":["web","report"]},{"url":"https://docs.djangoproject.com/en/3.2/releases/security","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qm57-vhq3-3fwf","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-8.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210611-0002","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2021/may/06/security-releases","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-32052","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0356.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28802","tags":["report"]},{"url":"https://www.djangoproject.com/weblog/2021/apr/06/security-releases/","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2021/may/04/security-releases/","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2021/jun/02/security-releases/","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2021/jul/01/security-releases/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.8/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.9/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.10/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.11/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.12/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.13/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2021/dla-2622","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4902-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4932-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4975-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-32052","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5373-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5373-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28347","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UHF5IZKTZ2T4T4QQYZMUFHW422X3WCU6/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185713","tags":["report"]},{"url":"https://bugzilla.suse.com/1186608","tags":["report"]},{"url":"https://bugzilla.suse.com/1186611","tags":["report"]},{"url":"https://bugzilla.suse.com/1193240","tags":["report"]},{"url":"https://bugzilla.suse.com/1194115","tags":["report"]},{"url":"https://bugzilla.suse.com/1194116","tags":["report"]},{"url":"https://bugzilla.suse.com/1194117","tags":["report"]},{"url":"https://bugzilla.suse.com/1195086","tags":["report"]},{"url":"https://bugzilla.suse.com/1195088","tags":["report"]},{"url":"https://bugzilla.suse.com/1198297","tags":["report"]},{"url":"https://bugzilla.suse.com/1198398","tags":["report"]},{"url":"https://bugzilla.suse.com/1198399","tags":["report"]},{"url":"https://bugzilla.suse.com/1201923","tags":["report"]},{"url":"https://bugzilla.suse.com/1203793","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-32052","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","status":"published","published":"2021-05-06T15:49:20Z","modified":"2024-08-03T23:17:28.409Z","updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2021-0065","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","status":"published","published":"2021-05-06T15:49:20Z","modified":"2024-08-03T23:17:28Z","updated_at":"2026-11-03T03:24:37.407491Z"}],"ghsa":[{"id":"GHSA-qm57-vhq3-3fwf","title":"Header injection possible in Django","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","status":"published","published":"2021-06-09T17:14:51Z","modified":"2024-09-20T15:28:26Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79","CWE-88"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2021-32052","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","status":"published","published":"2021-05-06T16:15:07.52Z","modified":"2026-06-17T03:52:43.533Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"CVE-2021-32052","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","status":"published","published":"2021-05-06T16:15:07.52Z","modified":"2026-10-24T10:30:33.033959972Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-32052","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","status":"published","published":"2021-05-06T16:15:07.52Z","modified":"2026-10-23T18:03:26.586811216Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-qm57-vhq3-3fwf","title":"Header injection possible in Django","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","status":"published","published":"2021-06-09T17:14:51Z","modified":"2024-09-20T15:33:15.953439Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79","CWE-88"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"UBUNTU-CVE-2021-32052","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","status":"published","published":"2021-05-06T16:15:00Z","modified":"2026-02-04T04:06:58.753401Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"BIT-django-2021-32052","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","status":"published","published":"2024-03-06T10:55:03.094Z","modified":"2026-09-08T08:46:25.51958582Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"MGASA-2021-0356","title":"Updated python-django package fixes security vulnerabilities","description":"In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8,\nMultiPartParser allowed directory traversal via uploaded files with suitably\ncrafted file names. Built-in upload handlers were not affected by this\nvulnerability (CVE-2021-28658).\n\nIn Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1,\nMultiPartParser, UploadedFile, and FieldFile allowed directory traversal via\nuploaded files with suitably crafted file names (CVE-2021-31542).\n\nIn Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with\nPython 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the\nURLField form field is used). If an application uses values with newlines in\nan HTTP response, header injection can occur. Django itself is unaffected\nbecause HttpResponse prohibits newlines in HTTP headers (CVE-2021-32052).\n\nDjango before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential\ndirectory traversal via django.contrib.admindocs. Staff members could use the\nTemplateDetailView view to check the existence of arbitrary files.\nAdditionally, if (and only if) the default admindocs templates have been\ncustomized by application developers to also show file contents, then not only\nthe existence but also the file contents would have been exposed. In other\nwords, there is directory traversal outside of the template root directories\n(CVE-2021-33203).\n\nIn Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4,\nURLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit\nleading zero characters in octal literals. This may allow a bypass of access\ncontrol that is based on IP addresses. (validate_ipv4_address and\nvalidate_ipv46_address are unaffected with Python 3.9.5+..) (CVE-2021-33571).\n\nDjango 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by\nSQL injection if order_by is untrusted input from a client of a web application\n(CVE-2021-35042).\n\npython-django package is updated to 3.1.13 version to fix these security\nissues among other upstream bugfixes, see upstream release notes.\n","status":"published","published":"2021-07-16T08:25:31Z","modified":"2026-04-16T04:42:40.255404813Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2023:0005-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2022-41323: Fixed potential denial-of-service vulnerability in internationalized URLs (boo#1203793)\n- CVE-2022-36359: Fixed a potential reflected file download vulnerability in FileResponse (boo#1201923)\n\n- Update from 2.2.12 to 2.2.28 (boo#1198297)\n\n  * Many CVEs fixes (check https://github.com/django/django/blob/main/docs/releases/)\n\n  2.2.28:\n\n  - CVE-2022-28346: Fixed potential SQL injection in QuerySet.annotate(), aggregate(), and extra() (bsc#1198398)\n  - CVE-2022-28347: Fixed potential SQL injection via QuerySet.explain(**options) (bsc#1198399)\n\n  2.2.27:\n\n  - CVE-2022-22818: Fixed possible XSS via ``{% debug %}`` template tag (bsc#1195086)\n  - CVE-2022-23833: Fixed denial-of-service possibility in file uploads (bsc#1195088)\n\n  2.2.26: \n\n  - CVE-2021-45115: Denial-of-service possibility in ``UserAttributeSimilarityValidator`` (bsc#1194115)\n  - CVE-2021-45116: Potential information disclosure in ``dictsort`` template filter (bsc#1194117)\n  - CVE-2021-45452: Potential directory-traversal via ``Storage.save()`` (bsc#)\n\n  2.2.25:\n\n  - CVE-2021-44420: Potential bypass of an upstream access control based on URL paths (bsc#1193240)\n\n  2.2.24:\n\n  - CVE-2021-33203: Potential directory traversal via ``admindocs``\n  - CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses\n\n  2.2.23:\n\n  - regression fix\n\n  2.2.22:\n\n  - CVE-2021-32052: Header injection possibility since ``URLValidator`` accepted newlines in input on Python 3.9.5+\n\n","status":"published","published":"2023-01-03T11:02:47Z","modified":"2026-02-04T02:49:35.167122Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11205-1","title":"python36-Django-3.2.7-2.3 on GA media","description":"These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:14.367485Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13887-1","title":"python310-Django-4.2.11-2.1 on GA media","description":"These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:27.577316Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14208-1","title":"python310-Django4-4.2.14-1.1 on GA media","description":"These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-19T00:00:00Z","modified":"2026-02-04T02:20:42.476564Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:10005-1","title":"python312-Django6-6.0-1.1 on GA media","description":"These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-03T00:00:00Z","modified":"2026-03-23T04:54:19.792844Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11235-1","title":"python313-Django4-4.2.30-4.1 on GA media","description":"These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.244458214Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11248-1","title":"python313-Django-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-11T09:15:07.179829219Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2021-8","description":"In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.","status":"published","published":"2021-05-06T16:15:00Z","modified":"2023-12-06T01:01:13.553156Z","updated_at":"2026-11-02T15:52:53.119977Z"},{"id":"USN-4975-1","title":"python-django vulnerabilities","description":"It was discovered that the Django URLValidator function incorrectly handled\nnewlines and tabs. A remote attacker could possibly use this issue to\nperform a header injection attack. This issue only affected Ubuntu 20.04\nLTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-32052)\n\nRasmus Lerchedahl Petersen and Rasmus Wriedt Larsen discovered that Django\nincorrectly handled path sanitation in admindocs. A remote attacker could\npossibly use this issue to determine the existence of arbitrary files and\nin certain configurations obtain their contents. (CVE-2021-33203)\n\nIt was discovered that Django incorrectly handled IPv4 addresses with\nleading zeros. A remote attacker could possibly use this issue to perform a\nwide variety of attacks, including bypassing certain access restrictions.\n(CVE-2021-33571)\n","status":"published","published":"2021-06-02T10:49:04Z","modified":"2026-02-10T04:42:12Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-5373-1","title":"python-django vulnerabilities","description":"It was discovered that Django incorrectly handled certain certain column\naliases in the QuerySet.annotate(), aggregate(), and extra() methods. A\nremote attacker could possibly use this issue to perform an SQL injection\nattack. (CVE-2022-28346)\n\nIt was discovered that Django incorrectly handled certain option names in\nthe QuerySet.explain() method. A remote attacker could possibly use this\nissue to perform an SQL injection attack. This issue only affected Ubuntu\n20.04 LTS, and Ubuntu 21.10. (CVE-2022-28347)\n\nIt was discovered that the Django URLValidator function incorrectly handled\nnewlines and tabs. A remote attacker could possibly use this issue to\nperform a header injection attack. This issue only affected Ubuntu 18.04\nLTS. (CVE-2021-32052)\n","status":"published","published":"2022-04-11T11:36:19Z","modified":"2026-02-10T04:42:34Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5373-2","title":"python-django vulnerabilities","description":"USN-5373-1 fixed several vulnerabilities in Django. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Django incorrectly handled certain certain column\n aliases in the QuerySet.annotate(), aggregate(), and extra() methods. A\n remote attacker could possibly use this issue to perform an SQL injection\n attack. (CVE-2022-28346)\n\n It was discovered that the Django URLValidator function incorrectly handled\n newlines and tabs. A remote attacker could possibly use this issue to\n perform a header injection attack. (CVE-2021-32052)\n","status":"published","published":"2022-04-11T12:29:27Z","modified":"2026-06-29T13:49:36.140700597Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}