Hi,

The following vulnerabilities were published for python-django.

https://www.djangoproject.com/weblog/2026/jul/07/security-releases/

CVE-2026-48588[0]:
| An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before
| 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator
| cache responses that vary on cookies when the incoming request
| carries unrelated cookies, which allows remote attackers to read
| private data from the shared cache. Earlier, unsupported Django
| series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may
| also be affected. Django would like to thank Chris Whyland for
| reporting this issue.


CVE-2026-53877[1]:
| An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before
| 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-
| memory buffer when constructed from a bytes object, which can
| disclose adjacent memory or cause service degradation via a
| potential segmentation fault when the `vsi_buffer` property is
| accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x,
| and 3.2.x) were not evaluated and may also be affected. Django would
| like to thank Bence Nagy for reporting this issue.


CVE-2026-53878[2]:
| An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before
| 5.2.16. `DomainNameValidator` does not prohibit newlines in domain
| names (unless used via a form field, since `CharField` strips
| newlines). If an application uses values with newlines in an HTTP
| response, header injection can occur. Django itself is unaffected
| because `HttpResponse` prohibits newlines in HTTP headers. Earlier,
| unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not
| evaluated and may also be affected. Django would like to thank Bence
| Nagy for reporting this issue.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-48588
https://www.cve.org/CVERecord?id=CVE-2026-48588
[1] https://security-tracker.debian.org/tracker/CVE-2026-53877
https://www.cve.org/CVERecord?id=CVE-2026-53877
[2] https://security-tracker.debian.org/tracker/CVE-2026-53878
https://www.cve.org/CVERecord?id=CVE-2026-53878


Regards,

We believe that the bug you reported is fixed in the latest version of
python-django, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141629@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <lamby@debian.org> (supplier of updated python-django package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 07 Jul 2026 09:28:48 -0700
Source: python-django
Built-For-Profiles: nocheck
Architecture: source
Version: 3:5.2.16-1
Distribution: unstable
Urgency: high
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Closes: 1141629
Changes:
 python-django (3:5.2.16-1) unstable; urgency=high
 .
   * New upstream security release:
 .
     - CVE-2026-48588: UpdateCacheMiddleware and the @cache_page decorator
       cached responses that vary on cookies when the incoming request carried
       unrelated cookies, which allowed remote attackers to read private data
       from the shared cache.
 .
     - CVE-2026-53877: django.contrib.gis.gdal.GDALRaster over-read its
       in-memory buffer when constructed from a bytes object, which could
       disclose adjacent memory or cause service degradation via a potential
       segmentation fault when the vsi_buffer property is accessed.
 .
     - CVE-2026-53878: DomainNameValidator did not prohibit newlines in domain
       names (unless used via a form field, since CharField strips newlines). If
       an application used values with newlines in an HTTP response, header
       injection could occur. Django itself is unaffected because HttpResponse
       prohibits newlines in HTTP headers.
 .
     <https://www.djangoproject.com/weblog/2026/jul/07/security-releases/>
 .
     (Closes: #1141629)
 .
   * Bump debhelper compatibility level to 14.
Checksums-Sha1:
 9ed6650d9acf36f06192f34bea63000d51395720 2790 python-django_5.2.16-1.dsc
 eaffb4974373d59955293e9e87a4052b7e14f55d 10890894 python-django_5.2.16.orig.tar.gz
 30fc77580dd492c2e0b48a5ebcde6e642c2cb0c1 38772 python-django_5.2.16-1.debian.tar.xz
 7e21db20b0463a7fd49f796e32c01180b81d806f 8199 python-django_5.2.16-1_amd64.buildinfo
Checksums-Sha256:
 ded9b174fad36f42a7075238849467304b3a3fe56e0d1cfd9949cc67558aa13f 2790 python-django_5.2.16-1.dsc
 59ea02020c3136fce14bef0bbece21a10a4febef5eed1c51c22ae468efa22200 10890894 python-django_5.2.16.orig.tar.gz
 534b99d5c8f7f7938dc8bbf820fd06b7582d130854e23a46800a4a6f155e560d 38772 python-django_5.2.16-1.debian.tar.xz
 bab292db20602a87d0b264ebefdced56fbd65d5a0621f41c876dd910c0df6e36 8199 python-django_5.2.16-1_amd64.buildinfo
Files:
 44db6d509bb10bf1bddbb2784575f010 2790 python optional python-django_5.2.16-1.dsc
 0fa6df374d72417d9f44f324c35ad4df 10890894 python optional python-django_5.2.16.orig.tar.gz
 2c3e548b61019789e7671fdb0edbd3a9 38772 python optional python-django_5.2.16-1.debian.tar.xz
 dd6182edbd93edcc62da1bde0dee4be5 8199 python optional python-django_5.2.16-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmpNLC0ACgkQHpU+J9Qx
HlhjaBAAt/CU31T/pGLMatl4VvzRqJJSJ6LZHx4C1cUG+0lFF4iUykWwSIGWxUu7
xQyBXcyV7il0dmgQ+oh554G2+Uhwvcn4ZzWHgWSuOF+J+/9PJlLtT1xniPbIm7Db
TCPKPlch73Ci27EJRiP9E7/BRRhJ64cds8t0hE/mtF4oK6dgkZ71vsy7alvxXKV0
6fcjEf94MZ13JSmumNXTD1lbxhw821eOLMQhQKO28ySeICtZyZ5XdaAWaGrcj+E0
xCPsYhimZH0ZDDcsWWU6MDrN3hovaRQoayIgchrVnVPBU0xCmnKgQ//C3eztVbmz
n6vuokfr0f1CCzgG4hN6ugQIwk9Fs7QU0DFHDpqQSGAweqBRepmmWNu3iby6F1W6
FbIZDbMuQhEJle3uDDILS6Dhu5WvFYJJZUmBDG/N+OqBYKO0PEwo1BnUi/G1Xr4f
GwdifhyZ7IJpi3aViommSXewHLcyeAM7aG5EPgpQQKVRu7YyXfF0cTm9s1D5OImL
zN/rxpfqAg+wtZKzFNCEIAlMTbYN2VR+OjMqW6MvKESMW6Aw3bo6MPYvojbb3jT2
06cdcTEzaoeWwOEmwskzpzeQ10PRbW76y548uSZlFs5PgFC4mBI7jUlS1BpVlF0y
GToGVPbBJ3EQzdFbGEOi4rWWKnIDi1g6rgZ4lgd64HVS8AVikT8=
=0Tg7
-----END PGP SIGNATURE-----