Skip to content
OpenAdvisories
Medium WID-SEC-2026-2231 3 CVEs

Django: Mehrere Schwachstellen

Published Jul 7, 2026 · Updated Sep 30, 2026 · Revision 6 · de-DE

Vendor: Debian Vendor: Fedora Vendor: SUSE Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen und Daten zu manipulieren.

Product

Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt.

Vulnerabilities 3

  • Medium 6.1
    CVE-2026-53878

    Header injection possibility since DomainNameValidator accepted newlines in input

    An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTT…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 4.8
    CVE-2026-53877

    Heap buffer over-read in GDALRaster

    An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potentia…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 4.2
    CVE-2026-48588

    Potential exposure of private data via cached Set-Cookie response

    An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read …

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

Revision history

  1. #6

    Neue Updates von Debian aufgenommen

  2. #5

    Neue Updates von Fedora aufgenommen

  3. #4

    Neue Updates von openSUSE aufgenommen

  4. #3

    Neue Updates von openSUSE aufgenommen

  5. #2

    Neue Updates von SUSE aufgenommen

  6. #1

    Initiale Fassung

References