Django 6.0.7/5.2.16 Security Update: 3 CVEs (Info Disclosure/Heap Overflow/Header Injection)

Vulnerability Overview Django released security update versions 6.0.7 and 5.2.16, addressing three security issues: 1. CVE-2026-48588: Exposure of private data via cached Set-Cookie responses. 2. CVE-2026-53877: Heap buffer over-read in . 3. CVE-2026-53878: Possibility of header injection due to accepting newline characters. Affected Scope CVE-2026-48588: Affects and . When a request does not contain cookies, responses containing cookies may be cached. CVE-2026-53877: Affects . Upon instantiation, the attribute may over-read the allocated buffer by approximately 32 bytes. CVE-2026-53878: Affects . Accepting newline characters may lead to header injection attacks. Remediation CVE-2026-48588: Patches have been applied to Django's main, 6.1 (currently in beta), 6.0, and 5.2 branches. CVE-2026-53877: Patches have been applied to Django's main, 6.1 (currently in beta), 6.0, and 5.2 branches. CVE-2026-53878: Patches have been applied to Django's main, 6.1 (currently in beta), 6.0, and 5.2 branches. Related Code CVE-2026-48588 CVE-2026-53877 CVE-2026-53878 Additional Information Supported Affected Versions: - Django main - Django 6.1 (currently in beta) - Django 6.0 - Django 5.2 Released Versions: - Django 6.0.7 (tarball - Django 5.2.16 (tarball PGP Key ID: 131403F4D16D8DC7 Security Reports: Please report potential security issues via private email to . Do not use Django's Trac instance or Django forums. Summary Django released security update versions 6.0.7 and 5.2.16, addressing three security issues: exposure of private data via cached Set-Cookie responses, heap buffer over-read in , and the possibility of header injection due to accepting newline characters. Patches have been applied to Django's main, 6.1 (currently in beta), 6.0, and 5.2 branches. All users are advised to upgrade as soon as possible.

Goal Reached Thanks to every supporter — we hit 100%!

Django 6.0.7/5.2.16 Security Update: 3 CVEs (Info Disclosure/Heap Overflow/Header Injection)