Vulnerability-Lookup

OPENSUSE-SU-2026:11236-1

Vulnerability from csaf_opensuse - Published: 2026-07-09 00:00 - Updated: 2026-09-17 17:13

Summary

python313-Django6-6.0.7-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: python313-Django6-6.0.7-1.1 on GA media

Description of the patch: These are all security issues fixed in the python313-Django6-6.0.7-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11236

CVE-2026-48588

3.1 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2026-53877

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 8 products, the same list as for CVE-2026-48588

Threats

Impact moderate

CVE-2026-53878

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Recommended 8 products, the same list as for CVE-2026-48588

Threats

Impact moderate

References

11 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-48588/	self
https://www.suse.com/security/cve/CVE-2026-53877/	self
https://www.suse.com/security/cve/CVE-2026-53878/	self
https://www.suse.com/security/cve/CVE-2026-48588	external
https://bugzilla.suse.com/1271029	external
https://www.suse.com/security/cve/CVE-2026-53877	external
https://bugzilla.suse.com/1271030	external
https://www.suse.com/security/cve/CVE-2026-53878	external
https://bugzilla.suse.com/1271031	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python313-Django6-6.0.7-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python313-Django6-6.0.7-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11236",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11236-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48588 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48588/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53877 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53877/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53878 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53878/"
      }
    ],
    "title": "python313-Django6-6.0.7-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-17T17:13:58Z",
      "generator": {
        "date": "2026-07-09T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11236-1",
      "initial_release_date": "2026-07-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-07-09T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:18:36Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:20:57Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:13:58Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Django6-0:6.0.7-1.1.aarch64",
                "product": {
                  "name": "python313-Django6-0:6.0.7-1.1.aarch64",
                  "product_id": "python313-Django6-0:6.0.7-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Django6@6.0.7-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Django6-0:6.0.7-1.1.aarch64",
                "product": {
                  "name": "python314-Django6-0:6.0.7-1.1.aarch64",
                  "product_id": "python314-Django6-0:6.0.7-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Django6@6.0.7-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Django6-0:6.0.7-1.1.ppc64le",
                "product": {
                  "name": "python313-Django6-0:6.0.7-1.1.ppc64le",
                  "product_id": "python313-Django6-0:6.0.7-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Django6@6.0.7-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Django6-0:6.0.7-1.1.ppc64le",
                "product": {
                  "name": "python314-Django6-0:6.0.7-1.1.ppc64le",
                  "product_id": "python314-Django6-0:6.0.7-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Django6@6.0.7-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Django6-0:6.0.7-1.1.s390x",
                "product": {
                  "name": "python313-Django6-0:6.0.7-1.1.s390x",
                  "product_id": "python313-Django6-0:6.0.7-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Django6@6.0.7-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Django6-0:6.0.7-1.1.s390x",
                "product": {
                  "name": "python314-Django6-0:6.0.7-1.1.s390x",
                  "product_id": "python314-Django6-0:6.0.7-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Django6@6.0.7-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Django6-0:6.0.7-1.1.x86_64",
                "product": {
                  "name": "python313-Django6-0:6.0.7-1.1.x86_64",
                  "product_id": "python313-Django6-0:6.0.7-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Django6@6.0.7-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Django6-0:6.0.7-1.1.x86_64",
                "product": {
                  "name": "python314-Django6-0:6.0.7-1.1.x86_64",
                  "product_id": "python314-Django6-0:6.0.7-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Django6@6.0.7-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Django6-0:6.0.7-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64"
        },
        "product_reference": "python313-Django6-0:6.0.7-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Django6-0:6.0.7-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le"
        },
        "product_reference": "python313-Django6-0:6.0.7-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Django6-0:6.0.7-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x"
        },
        "product_reference": "python313-Django6-0:6.0.7-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Django6-0:6.0.7-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64"
        },
        "product_reference": "python313-Django6-0:6.0.7-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Django6-0:6.0.7-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64"
        },
        "product_reference": "python314-Django6-0:6.0.7-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Django6-0:6.0.7-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le"
        },
        "product_reference": "python314-Django6-0:6.0.7-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Django6-0:6.0.7-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x"
        },
        "product_reference": "python314-Django6-0:6.0.7-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Django6-0:6.0.7-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64"
        },
        "product_reference": "python314-Django6-0:6.0.7-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-48588",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48588"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Chris Whyland for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x",
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48588",
          "url": "https://www.suse.com/security/cve/CVE-2026-48588"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271029 for CVE-2026-48588",
          "url": "https://bugzilla.suse.com/1271029"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-09T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-48588"
    },
    {
      "cve": "CVE-2026-53877",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53877"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x",
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53877",
          "url": "https://www.suse.com/security/cve/CVE-2026-53877"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271030 for CVE-2026-53877",
          "url": "https://bugzilla.suse.com/1271030"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-53877"
    },
    {
      "cve": "CVE-2026-53878",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53878"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x",
          "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x",
          "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53878",
          "url": "https://www.suse.com/security/cve/CVE-2026-53878"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271031 for CVE-2026-53878",
          "url": "https://bugzilla.suse.com/1271031"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python313-Django6-0:6.0.7-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.s390x",
            "openSUSE Tumbleweed:python314-Django6-0:6.0.7-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-53878"
    }
  ]
}

CVE-2026-48588 (GCVE-0-2026-48588)

Vulnerability from cvelistv5 – Published: 2026-07-07 14:09 – Updated: 2026-07-07 14:59

Title

Potential exposure of private data via cached Set-Cookie response

Summary

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-07 14:59 UTC

CWE

CWE-524 - Use of Cache Containing Sensitive Information

Assigner

DSF mitre root

References

3 references

URL	Tags
https://docs.djangoproject.com/en/dev/releases/se…	vendor-advisory
https://groups.google.com/g/django-announce	mailing-list
https://www.djangoproject.com/weblog/2026/jul/07/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
djangoproject	Django	Affected: 6.0 , < 6.0.7 (python) Unaffected: 6.0.7 (python) Affected: 5.2 , < 5.2.16 (python) Unaffected: 5.2.16 (python)

Date Public

2026-07-07 09:00

Credits

Chris Whyland Natalia Bidart Jacob Walls

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-07T14:59:46.664212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-07T14:59:53.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/Django/",
          "defaultStatus": "unaffected",
          "packageName": "django",
          "product": "Django",
          "repo": "https://github.com/django/django/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThan": "6.0.7",
              "status": "affected",
              "version": "6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.0.7",
              "versionType": "python"
            },
            {
              "lessThan": "5.2.16",
              "status": "affected",
              "version": "5.2",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "5.2.16",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Chris Whyland"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Natalia Bidart"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jacob Walls"
        }
      ],
      "datePublic": "2026-07-07T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\u003c/p\u003e\u003cp\u003e\u003ccode\u003eUpdateCacheMiddleware\u003c/code\u003e and the \u003ccode\u003ecache_page()\u003c/code\u003e decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Chris Whyland for reporting this issue.\u003c/p\u003e"
            }
          ],
          "value": "An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Chris Whyland for reporting this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-204",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-204: Lifting Sensitive Data Embedded in Cache"
            }
          ]
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
              "value": "low"
            },
            "type": "Django severity rating"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-524",
              "description": "CWE-524: Use of Cache Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-07T14:09:32.687Z",
        "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "shortName": "DSF"
      },
      "references": [
        {
          "name": "Django security archive",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.djangoproject.com/en/dev/releases/security/"
        },
        {
          "name": "Django releases announcements",
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/django-announce"
        },
        {
          "name": "Django security releases issued: 6.0.7 and 5.2.16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.djangoproject.com/weblog/2026/jul/07/security-releases/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-16T12:00:00.000Z",
          "value": "Initial report received."
        },
        {
          "lang": "en",
          "time": "2026-05-21T12:00:00.000Z",
          "value": "Vulnerability confirmed."
        },
        {
          "lang": "en",
          "time": "2026-07-07T09:00:00.000Z",
          "value": "Security release issued."
        }
      ],
      "title": "Potential exposure of private data via cached Set-Cookie response",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
    "assignerShortName": "DSF",
    "cveId": "CVE-2026-48588",
    "datePublished": "2026-07-07T14:09:32.687Z",
    "dateReserved": "2026-05-21T20:50:32.466Z",
    "dateUpdated": "2026-07-07T14:59:53.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53877 (GCVE-0-2026-53877)

Vulnerability from cvelistv5 – Published: 2026-07-07 14:10 – Updated: 2026-07-07 14:59

Title

Heap buffer over-read in GDALRaster

Summary

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-07 14:58 UTC

CWE

CWE-805 - Buffer Access with Incorrect Length Value

Assigner

DSF mitre root

References

3 references

URL	Tags
https://docs.djangoproject.com/en/dev/releases/se…	vendor-advisory
https://groups.google.com/g/django-announce	mailing-list
https://www.djangoproject.com/weblog/2026/jul/07/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
djangoproject	Django	Affected: 6.0 , < 6.0.7 (python) Unaffected: 6.0.7 (python) Affected: 5.2 , < 5.2.16 (python) Unaffected: 5.2.16 (python)

Date Public

2026-07-07 09:00

Credits

Bence Nagy Jacob Walls Jacob Walls

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53877",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-07T14:58:59.505374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-07T14:59:07.106Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/Django/",
          "defaultStatus": "unaffected",
          "packageName": "django",
          "product": "Django",
          "repo": "https://github.com/django/django/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThan": "6.0.7",
              "status": "affected",
              "version": "6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.0.7",
              "versionType": "python"
            },
            {
              "lessThan": "5.2.16",
              "status": "affected",
              "version": "5.2",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "5.2.16",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bence Nagy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jacob Walls"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jacob Walls"
        }
      ],
      "datePublic": "2026-07-07T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\u003c/p\u003e\u003cp\u003e\u003ccode\u003edjango.contrib.gis.gdal.GDALRaster\u003c/code\u003e over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the \u003ccode\u003evsi_buffer\u003c/code\u003e property is accessed.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Bence Nagy for reporting this issue.\u003c/p\u003e"
            }
          ],
          "value": "An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy for reporting this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-540",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-540: Overread Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
              "value": "low"
            },
            "type": "Django severity rating"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-805",
              "description": "CWE-805: Buffer Access with Incorrect Length Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-07T14:10:04.025Z",
        "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "shortName": "DSF"
      },
      "references": [
        {
          "name": "Django security archive",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.djangoproject.com/en/dev/releases/security/"
        },
        {
          "name": "Django releases announcements",
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/django-announce"
        },
        {
          "name": "Django security releases issued: 6.0.7 and 5.2.16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.djangoproject.com/weblog/2026/jul/07/security-releases/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-02T12:00:00.000Z",
          "value": "Initial report received."
        },
        {
          "lang": "en",
          "time": "2026-06-11T12:00:00.000Z",
          "value": "Vulnerability confirmed."
        },
        {
          "lang": "en",
          "time": "2026-07-07T09:00:00.000Z",
          "value": "Security release issued."
        }
      ],
      "title": "Heap buffer over-read in GDALRaster",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
    "assignerShortName": "DSF",
    "cveId": "CVE-2026-53877",
    "datePublished": "2026-07-07T14:10:04.025Z",
    "dateReserved": "2026-06-11T01:11:27.545Z",
    "dateUpdated": "2026-07-07T14:59:07.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53878 (GCVE-0-2026-53878)

Vulnerability from cvelistv5 – Published: 2026-07-07 14:10 – Updated: 2026-07-07 14:58

Title

Header injection possibility since DomainNameValidator accepted newlines in input

Summary

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-07 14:58 UTC

CWE

CWE-144 - Improper Neutralization of Line Delimiters

Assigner

DSF mitre root

References

3 references

URL	Tags
https://docs.djangoproject.com/en/dev/releases/se…	vendor-advisory
https://groups.google.com/g/django-announce	mailing-list
https://www.djangoproject.com/weblog/2026/jul/07/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
djangoproject	Django	Affected: 6.0 , < 6.0.7 (python) Unaffected: 6.0.7 (python) Affected: 5.2 , < 5.2.16 (python) Unaffected: 5.2.16 (python)

Date Public

2026-07-07 09:00

Credits

Bence Nagy Natalia Bidart Jacob Walls

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53878",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-07T14:58:12.426667Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-07T14:58:18.415Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/Django/",
          "defaultStatus": "unaffected",
          "packageName": "django",
          "product": "Django",
          "repo": "https://github.com/django/django/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThan": "6.0.7",
              "status": "affected",
              "version": "6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.0.7",
              "versionType": "python"
            },
            {
              "lessThan": "5.2.16",
              "status": "affected",
              "version": "5.2",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "5.2.16",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bence Nagy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Natalia Bidart"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jacob Walls"
        }
      ],
      "datePublic": "2026-07-07T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\u003c/p\u003e\u003cp\u003e\u003ccode\u003eDomainNameValidator\u003c/code\u003e does not prohibit newlines in domain names (unless used via a form field, since \u003ccode\u003eCharField\u003c/code\u003e strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because \u003ccode\u003eHttpResponse\u003c/code\u003e prohibits newlines in HTTP headers.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Bence Nagy for reporting this issue.\u003c/p\u003e"
            }
          ],
          "value": "An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy for reporting this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-34",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-34: HTTP Response Splitting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
              "value": "low"
            },
            "type": "Django severity rating"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-144",
              "description": "CWE-144: Improper Neutralization of Line Delimiters",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-07T14:10:29.935Z",
        "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "shortName": "DSF"
      },
      "references": [
        {
          "name": "Django security archive",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.djangoproject.com/en/dev/releases/security/"
        },
        {
          "name": "Django releases announcements",
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/django-announce"
        },
        {
          "name": "Django security releases issued: 6.0.7 and 5.2.16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.djangoproject.com/weblog/2026/jul/07/security-releases/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-02T12:00:00.000Z",
          "value": "Initial report received."
        },
        {
          "lang": "en",
          "time": "2026-06-11T12:00:00.000Z",
          "value": "Vulnerability confirmed."
        },
        {
          "lang": "en",
          "time": "2026-07-07T09:00:00.000Z",
          "value": "Security release issued."
        }
      ],
      "title": "Header injection possibility since DomainNameValidator accepted newlines in input",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
    "assignerShortName": "DSF",
    "cveId": "CVE-2026-53878",
    "datePublished": "2026-07-07T14:10:29.935Z",
    "dateReserved": "2026-06-11T01:11:27.546Z",
    "dateUpdated": "2026-07-07T14:58:18.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:11236-1

CVE-2026-48588 (GCVE-0-2026-48588)

CVE-2026-53877 (GCVE-0-2026-53877)

CVE-2026-53878 (GCVE-0-2026-53878)

Tags

Sightings

Nomenclature

Related by attack behaviour