{"action":"Upgrade django to 5.2.16 or later.","affected":[{"fixed":"5.2.16","introduced":"0"},{"fixed":"6.0.7","introduced":"6.0.0"}],"component":"django","cve_ids":["CVE-2026-53878"],"ecosystem":"PyPI","epss":0.00327,"exploited":false,"fixed_versions":["5.2.16","6.0.7"],"ghsa_id":"GHSA-8qcx-xf44-272x","id":"tcs_01M5KF8VXM94357Y52R6WYHFAP","modified_at":"2026-09-10T03:51:11.070082151Z","published_at":"2026-07-07T15:32:57Z","references":["https://osv.dev/vulnerability/GHSA-8qcx-xf44-272x","https://nvd.nist.gov/vuln/detail/CVE-2026-53878","https://github.com/django/django/commit/3a720d0d8bf2529253b98968f10ca73daf6d693c","https://github.com/django/django/commit/a5de13f1491f1dbf2bb0ad9b91570524ebbc8acd","https://github.com/django/django/commit/d5d60ed0323cddaa0ce0237a26a3d49ac21ee05e","https://docs.djangoproject.com/en/dev/releases/security","https://github.com/django/django","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2092.yaml","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/jul/07/security-releases"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-8qcx-xf44-272x","url":"https://osv.dev/vulnerability/GHSA-8qcx-xf44-272x"}],"summary":"Django: DomainNameValidator permits newline characters that may enable HTTP header injection"}