Bug 2497329 (CVE-2026-53878)

Summary: CVE-2026-53878 django: Django: HTTP header injection via DomainNameValidator accepting newlines
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: anthomas, brasmith, cmyers, cochase, dnakabaa, dranck, dschmidt, ehelms, ggainey, jlanda, jmitchel, jpasqual, juwatts, jwong, kaycoth, kshier, lcouzens, mdellweg, mhulan, nmoumoul, omaciel, osousa, pcreech, rchan, security-response-team, simaishi, smallamp, stcannon, teagle, tmalecek, ttakamiy, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Django. django.core.validators.DomainNameValidator accepted newline characters in domain name input. When applications use this validator outside Django form fields and include the validated value in HTTP response headers, a remote attacker could perform HTTP header injection. Django core is not affected because HttpResponse rejects newlines in headers, and CharField strips newlines by default.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-07-07   
Attachments:
Description Flags
0003-5.2.x-Fixed-CVE-2026-53878-Prevented-newlines-from-b.patch
none
0003-6.0.x-Fixed-CVE-2026-53878-Prevented-newlines-from-b.patch
none
0003-6.1.x-Fixed-CVE-2026-53878-Prevented-newlines-from-b.patch
none
0003-Fixed-CVE-2026-53878-Prevented-newlines-from-being-a.patch none

Description OSIDB Bzimport 2026-07-06 11:44:51 UTC 
A flaw was found in Django. django.core.validators.DomainNameValidator accepted newline characters in domain names. If validated values are placed directly into HTTP response headers outside Django's form handling, a remote attacker could inject additional headers.
Comment 2 Yadnyawalk Tale 2026-07-06 12:12:00 UTC 
Created attachment 2147816 [details]
0003-5.2.x-Fixed-CVE-2026-53878-Prevented-newlines-from-b.patch
Comment 3 Yadnyawalk Tale 2026-07-06 12:12:03 UTC 
Created attachment 2147817 [details]
0003-6.0.x-Fixed-CVE-2026-53878-Prevented-newlines-from-b.patch
Comment 4 Yadnyawalk Tale 2026-07-06 12:12:06 UTC 
Created attachment 2147818 [details]
0003-6.1.x-Fixed-CVE-2026-53878-Prevented-newlines-from-b.patch
Comment 5 Yadnyawalk Tale 2026-07-06 12:12:08 UTC 
Created attachment 2147819 [details]
0003-Fixed-CVE-2026-53878-Prevented-newlines-from-being-a.patch