{"title":"Django 5.2.16 release notes","version":"dev","locale":"en","docname":"releases/5.2.16","url":"/en/dev/releases/5.2.16/","canonical":"https://djangodocs.dev/en/dev/releases/5.2.16/","summary":"Django 5.2.16 fixes three security issues with severity “low” in 5.2.15. UpdateCacheMiddleware and cache_page() avoided caching responses that set a cookie…","html":"<h1>Django 5.2.16 release notes<a class=\"heading-anchor\" href=\"#django-5-2-16-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>July 7, 2026</em></p>\n<p>Django 5.2.16 fixes three security issues with severity “low” in 5.2.15.</p>\n<section id=\"cve-2026-48588-potential-exposure-of-private-data-via-cached-set-cookie-response\">\n<h2>CVE-2026-48588: Potential exposure of private data via cached <code class=\"docutils literal notranslate\">Set-Cookie</code> response<a class=\"heading-anchor\" href=\"#cve-2026-48588-potential-exposure-of-private-data-via-cached-set-cookie-response\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/middleware/#django.middleware.cache.UpdateCacheMiddleware\" title=\"django.middleware.cache.UpdateCacheMiddleware\"><code class=\"xref py py-class docutils literal notranslate\">UpdateCacheMiddleware</code></a> and\n<a class=\"reference internal\" href=\"/en/dev/topics/cache/#django.views.decorators.cache.cache_page\" title=\"django.views.decorators.cache.cache_page\"><code class=\"xref py py-func docutils literal notranslate\">cache_page()</code></a> avoided caching responses\nthat set a cookie while varying on <code class=\"docutils literal notranslate\">Cookie</code> only when the incoming request\ncontained no cookies at all. When the request already carried an unrelated\ncookie (such as a language or theme preference cookie), the protection did not\napply, allowing a response that sets a session or other sensitive cookie to be\nstored in Django’s shared cache.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>\n<section id=\"cve-2026-53877-heap-buffer-over-read-in-gdalraster\">\n<h2>CVE-2026-53877: Heap buffer over-read in <code class=\"docutils literal notranslate\">GDALRaster</code><a class=\"heading-anchor\" href=\"#cve-2026-53877-heap-buffer-over-read-in-gdalraster\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>When <a class=\"reference internal\" href=\"/en/dev/ref/contrib/gis/gdal/#django.contrib.gis.gdal.GDALRaster\" title=\"django.contrib.gis.gdal.GDALRaster\"><code class=\"xref py py-class docutils literal notranslate\">GDALRaster</code></a> was instantiated with a bytes\nobject representing a raster file, the\n<a class=\"reference internal\" href=\"/en/dev/ref/contrib/gis/gdal/#django.contrib.gis.gdal.GDALRaster.vsi_buffer\" title=\"django.contrib.gis.gdal.GDALRaster.vsi_buffer\"><code class=\"xref py py-attr docutils literal notranslate\">vsi_buffer</code></a> property could over-read\nthe allocated buffer by approximately 32 bytes. This could result in\ninformation disclosure of adjacent heap memory or, in rare cases, a\nsegmentation fault. Only rasters stored in GDAL’s virtual filesystem were\naffected.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>\n<section id=\"cve-2026-53878-header-injection-possibility-since-domainnamevalidator-accepted-newlines-in-input\">\n<h2>CVE-2026-53878: Header injection possibility since <code class=\"docutils literal notranslate\">DomainNameValidator</code> accepted newlines in input<a class=\"heading-anchor\" href=\"#cve-2026-53878-header-injection-possibility-since-domainnamevalidator-accepted-newlines-in-input\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/validators/#django.core.validators.DomainNameValidator\" title=\"django.core.validators.DomainNameValidator\"><code class=\"xref py py-class docutils literal notranslate\">DomainNameValidator</code></a> accepted newlines in\ndomain names. If such values were included in HTTP responses, header injection\nattacks were possible. Django itself wasn’t vulnerable because\n<a class=\"reference internal\" href=\"/en/dev/ref/request-response/#django.http.HttpResponse\" title=\"django.http.HttpResponse\"><code class=\"xref py py-class docutils literal notranslate\">HttpResponse</code></a> prohibits newlines in HTTP headers.</p>\n<p>The vulnerability only affected uses of <code class=\"docutils literal notranslate\">DomainNameValidator</code> outside Django\nform fields, as <code class=\"docutils literal notranslate\">CharField</code> strips newlines by default.</p>\n<p>This issue has severity “low” according to the <a class=\"reference internal\" href=\"/en/dev/internals/security/#severity-levels\"><span class=\"std std-ref\">Django security policy</span></a>.</p>\n</section>","rootId":"django-5-2-16-release-notes","toc":[{"title":"CVE-2026-48588: Potential exposure of private data via cached Set-Cookie response","anchor":"cve-2026-48588-potential-exposure-of-private-data-via-cached-set-cookie-response","children":[]},{"title":"CVE-2026-53877: Heap buffer over-read in GDALRaster","anchor":"cve-2026-53877-heap-buffer-over-read-in-gdalraster","children":[]},{"title":"CVE-2026-53878: Header injection possibility since DomainNameValidator accepted newlines in input","anchor":"cve-2026-53878-header-injection-possibility-since-domainnamevalidator-accepted-newlines-in-input","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/5.2.17","title":"Django 5.2.17 release notes","url":"/en/dev/releases/5.2.17/"},"next":{"docname":"releases/5.2.15","title":"Django 5.2.15 release notes","url":"/en/dev/releases/5.2.15/"},"formats":{"html":"/en/dev/releases/5.2.16/","markdown":"/en/dev/releases/5.2.16.md","json":"/en/dev/releases/5.2.16.json"},"source":"https://github.com/django/django/blob/main/docs/releases/5.2.16.txt","official":"https://docs.djangoproject.com/en/dev/releases/5.2.16/","inVersions":["dev","6.1","6.0","5.2"],"inLocales":["en"]}