An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

Django vulnerable to Uncontrolled Resource Consumption

Cross-site scripting in django

Django has a denial-of-service possibility in strip_tags()

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.

Information disclosure in Django

Django Reuses Cached CSRF Token

Django denial-of-service in django.utils.html.strip_tags()

Django Improper Output Neutralization for Logs vulnerability

Improper date handling in Django

Django Cross-site Scripting in AdminURLFieldWidget

Django WSGI Header Spoofing Vulnerability

Django Denial of service vulnerability in django.utils.encoding.uri_to_iri

Django Uses Persistent Cookies Containing Sensitive Information

Directory traversal in Django

Django cross-site scripting (XSS) attack via user-supplied redirect URLs

Django vulnerable to a denial-of-service attack

Django Allows Redirect via Data URL

Django allows user sessions hijacking via an empty string in the session key

Django settings leak in date template filter