DomainNameValidator in Django permits newline characters in domain names. When an application places such a domain name directly into an HTTP response header without validation, the newline can split the header and enable header injection. This flaw therefore provides a path for malicious manipulation of HTTP responses.

Django releases earlier than 6.0.7 and 5.2.16 are affected. The flaw was identified in Django 6.0 before 6.0.7 and in Django 5.2 before 5.2.16. Earlier unsupported branches such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but may contain identical code and consequently could also be vulnerable.

The CVSS score of 5.3 places the vulnerability in the medium severity range. Exploitation requires that an attacker be able to supply a domain name that the application writes to a header without prior sanitization, thereby limiting the attack scope to the application’s own logic or input handling. The EPSS score of <1% indicates a very low probability of real-world exploitation. Django’s own HttpResponse sanitizes headers, so the core framework remains safe; the risk arises only when application code bypasses that protection. The vulnerability is not listed in the CISA KEV catalog.