This vulnerability arises because the DomainNameValidator in Django versions 6.0 prior to 6.0.7 and 5.2 prior to 5.2.16 does not restrict newline characters in domain name inputs. If an application uses such domain names containing newlines in HTTP response headers, it could lead to HTTP header injection. However, Django's HttpResponse class inherently blocks newlines in headers, mitigating direct exploitation within Django itself. The vulnerability was reported by Bence Nagy. Unsupported older Django versions (5.0.x, 4.1.x, 3.2.x) were not assessed and might also be vulnerable. A fix has been released in the updated versions.

The vulnerability could allow HTTP header injection if an application improperly uses domain names containing newline characters in HTTP response headers. This can lead to partial compromise of HTTP response integrity, potentially affecting confidentiality and integrity of HTTP communications. However, since Django's HttpResponse class prohibits newlines in headers, the framework itself is not directly exploitable. The impact is limited to applications that bypass or do not use Django's standard HTTP response handling.

A patch is available in Django versions 6.0.7 and 5.2.16 that addresses this issue by properly prohibiting newlines in domain names validated by DomainNameValidator. Users should upgrade to these or later versions to remediate the vulnerability. Since Django's HttpResponse class already prevents newlines in headers, applications using standard Django response handling are not directly vulnerable. No additional mitigation is required beyond applying the official patch.