Django allows newline characters in domain names, enabling header injection

Versions of Django 5.2 up to 5.2.15 and 6.0 up to 6.0.6 may accept domain names that contain line-break characters. If your code inserts such values into HTTP responses, an attacker could insert extra lines into headers, potentially altering how browsers or servers handle the request. Upgrade Django to the latest 5.2 or 6.0 release, or ensure any domain input is stripped of newline characters before use.

• https://advisory.echohq.com/cve/CVE-2026-53878 URL
• https://github.com/advisories/GHSA-8qcx-xf44-272x URL