Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN734
_____________________________________________________________________


DATE                : 08/07/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Django versions prior to 6.0.7,
                                      5.2.16.
 
=====================================================================

https://www.djangoproject.com/weblog/2026/jul/07/security-releases/
_____________________________________________________________________


Django security releases issued: 6.0.7 and 5.2.16
Posted by Jacob Walls on 7 juillet 2026

In accordance with our security release policy, the Django team is
issuing releases for Django 6.0.7 and Django 5.2.16. These releases
address the security issues detailed below. We encourage all users
of Django to upgrade as soon as possible.
CVE-2026-48588: Potential exposure of private data via cached
Set-Cookie response

django.middleware.cache.UpdateCacheMiddleware and
django.views.decorators.cache.cache_page avoided caching responses
that set a cookie while varying on Cookie only when the incoming
request contained no cookies at all. When the request already
carried an unrelated cookie (such as a language or theme preference
cookie), the protection did not apply, allowing a response that
sets a session or other sensitive cookie to be stored in Django's
shared cache.

This issue has severity "low" according to the Django security
policy.

Thanks to Chris Whyland for the report.

CVE-2026-53877: Heap buffer over-read in GDALRaster

When django.contrib.gis.gdal.GDALRaster was instantiated with a
bytes object representing a raster file, the vsi_buffer property
could over-read the allocated buffer by approximately 32 bytes.
This could result in information disclosure of adjacent heap
memory or, in rare cases, a segmentation fault. Only rasters
stored in GDAL's virtual filesystem were affected.

This issue has severity "low" according to the Django security
policy.

Thanks to Bence Nagy for the report.


CVE-2026-53878: Header injection possibility since
DomainNameValidator accepted newlines in input

django.core.validators.DomainNameValidator accepted newlines
in domain names. If such values were included in HTTP responses,
header injection attacks were possible. Django itself wasn't
vulnerable because HttpResponse prohibits newlines in HTTP
headers.

The vulnerability only affected uses of DomainNameValidator
outside Django form fields, as CharField strips newlines by
default.

This issue has severity "low" according to the Django
security policy.

Thanks to Bence Nagy for the report.


Affected supported versions

    Django main
    Django 6.1 (currently at beta status)
    Django 6.0
    Django 5.2


Resolution

Patches to resolve the issue have been applied to
Django's main, 6.1 (currently at beta status), 6.0, and
5.2 branches. The patches may be obtained from the
following changesets.


CVE-2026-48588: Potential exposure of private data via
cached Set-Cookie response

    On the main branch
    On the 6.1 branch
    On the 6.0 branch
    On the 5.2 branch

CVE-2026-53877: Heap buffer over-read in GDALRaster

    On the main branch
    On the 6.1 branch
    On the 6.0 branch
    On the 5.2 branch

CVE-2026-53878: Header injection possibility since
DomainNameValidator accepted newlines in input

    On the main branch
    On the 6.1 branch
    On the 6.0 branch
    On the 5.2 branch

The following releases have been issued

    Django 6.0.7 (tarball | checksums)
    Django 5.2.16 (tarball | checksums)

The PGP key ID used for this release is Jacob Walls:
131403F4D16D8DC7


General notes regarding security reporting

As always, we ask that potential security issues be reported
via private email to security@djangoproject.com, and not via
Django's Trac instance, nor via the Django Forum. Please see
our security policies for further information.


=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================