Description
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1:1.10.3-1 | — |
| Debian 13 | python-django | 1:1.10.3-1 | — |
| Debian 12 | python-django | 1:1.10.3-1 | — |
| Debian 8 | python-django | 1.7.11-1+deb8u2 | DSA-3835-1 |
| Debian 7 | python-django | 1.4.22-1+deb7u2 | DLA-706-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | python-django | 1.8.7-1ubuntu5.4 | USN-3115-1 |
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.16 | USN-3115-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 7 | python-Django | 1.8.19-3.4.1 | SUSE-SU-2018:0973-1 |
| SUSE OpenStack Cloud 6 | python-Django | 1.8.19-3.6.1 | SUSE-SU-2018:1102-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-django | 1.8.16-r0 | — |
| Alpine v3.23 | py3-django | 1.8.16-r0 | — |
| Alpine v3.22 | py3-django | 1.8.16-r0 | — |
| Alpine v3.21 | py3-django | 1.8.16-r0 | — |
| Alpine v3.20 | py3-django | 1.8.16-r0 | — |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-django | 1.8.16-r0 | — |
| Alpine v3.18 | py3-django | 1.8.16-r0 | — |
| Alpine v3.17 | py3-django | 1.8.16-r0 | — |
| Alpine v3.16 | py3-django | 1.8.16-r0 | — |
| Alpine v3.15 | py3-django | 1.8.16-r0 | — |
| Alpine v3.14 | py3-django | 1.8.16-r0 | — |
| Alpine v3.13 | py3-django | 1.8.16-r0 | — |
| Alpine v3.12 | py3-django | 1.8.16-r0 | — |
| Alpine v3.11 | py3-django | 1.8.16-r0 | — |
| Alpine v3.10 | py-django | 1.8.16-r0 | — |
| Alpine v3.9 | py-django | 1.8.16-r0 | — |
| Alpine v3.8 | py-django | 1.8.16-r0 | — |
| Alpine v3.7 | py-django | 1.8.16-r0 | — |
| Alpine v3.6 | py-django | 1.8.16-r0 | — |
| Alpine v3.5 | py-django | 1.8.16-r0 | — |
| Alpine v3.4 | py-django | 1.8.16-r0 | — |
| Alpine v3.3 | py-django | 1.8.16-r0 | — |
| Alpine v3.2 | py-django | 1.8.16-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 1.8a1, < 1.8.16 | 1.8.16 | GHSA-3f2c-jm6v-cr35 |
| PyPI | django | >= 1.9a1, < 1.9.11 | 1.9.11 | GHSA-3f2c-jm6v-cr35 |
| PyPI | django | >= 1.10a1, < 1.10.3 | 1.10.3 | GHSA-3f2c-jm6v-cr35 |
| PyPI | django | < 1.8.16 · >= 1.9, < 1.9.11 · >= 1.10, < 1.10.3 | 1.8.16, 1.9.11, 1.10.3 | PYSEC-2016-18 |
Advisories 5
- DLA-706-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3835-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3115-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2018:1102-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0973-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
- FEDORA-2016-d4571bf555 vendor-advisory
- 94068 vdb-entry
- DSA-3835 vendor-advisory
- USN-3115-1 vendor-advisory
- 1037159 vdb-entry
- FEDORA-2016-3eb5a55123 vendor-advisory