# Django 5.2.17 documentation

# Django 5.2.16 release notes

July 7, 2026

Django 5.2.16 fixes three security issues with severity “low” in 5.2.15.

## CVE-2026-48588: Potential exposure of private data via cached `Set-Cookie` response

`UpdateCacheMiddleware` and `cache_page()` avoided caching responses that set a cookie while varying on `Cookie` only when the incoming request contained no cookies at all. When the request already carried an unrelated cookie (such as a language or theme preference cookie), the protection did not apply, allowing a response that sets a session or other sensitive cookie to be stored in Django’s shared cache.

This issue has severity “low” according to the Django security policy.

## CVE-2026-53877: Heap buffer over-read in `GDALRaster`

When `GDALRaster` was instantiated with a bytes object representing a raster file, the `vsi_buffer` property could over-read the allocated buffer by approximately 32 bytes. This could result in information disclosure of adjacent heap memory or, in rare cases, a segmentation fault. Only rasters stored in GDAL’s virtual filesystem were affected.

This issue has severity “low” according to the Django security policy.

## CVE-2026-53878: Header injection possibility since `DomainNameValidator` accepted newlines in input

`DomainNameValidator` accepted newlines in domain names. If such values were included in HTTP responses, header injection attacks were possible. Django itself wasn’t vulnerable because `HttpResponse` prohibits newlines in HTTP headers.

The vulnerability only affected uses of `DomainNameValidator` outside Django form fields, as `CharField` strips newlines by default.

This issue has severity “low” according to the Django security policy.