The vulnerability arises because Django's DomainNameValidator allows newline characters in domain names unless the domain name is used via a form field, where CharField strips newlines. If an application uses domain names containing newlines in HTTP response headers, it could lead to HTTP header injection. However, Django's HttpResponse class prohibits newlines in HTTP headers, mitigating the risk within the framework itself. The affected versions include Django 6.0 prior to 6.0.7 and 5.2 prior to 5.2.16. Earlier unsupported versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but may also be vulnerable. No official remediation level or patch links are provided in the data.

The vulnerability could allow HTTP header injection if an application improperly uses domain names with newlines in HTTP responses. This could lead to partial compromise of HTTP response integrity, potentially affecting confidentiality and integrity of communications. The Django framework itself is not directly vulnerable due to internal protections in HttpResponse. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Applications should avoid using untrusted domain name inputs containing newlines in HTTP headers. Since Django's HttpResponse class prohibits newlines in headers, using standard Django response handling mitigates the risk. Monitor official Django project advisories for updates and apply patches when available.