Vulnerability advisory

PYSEC-2016-18

Published Dec 9, 2016Updated Jun 10, 2026OSV record ↗

Also known as CVE-2016-9014GHSA-3f2c-jm6v-cr35

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
All versions before 1.8.16	`1.8.16`Advisories →
`1.9` to before 1.9.11	`1.9.11`Advisories →
`1.10` to before 1.10.3	`1.10.3`Advisories →
Also listed as affected (119) `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.1` `1.1.1` `1.1.2` `1.1.3` `1.1.4` `1.10` `1.10.1` `1.10.2` `1.2` `1.2.1` `1.2.2` `1.2.3` `1.2.4` `1.2.5` `1.2.6` `1.2.7` `1.3` `1.3.1` `1.3.2` `1.3.3` `1.3.4` `1.3.5` `1.3.6` `1.3.7` `1.4` `1.4.1` `1.4.10` `1.4.11` `1.4.12` `1.4.13` `1.4.14` `1.4.15` `1.4.16` `1.4.17` `1.4.18` `1.4.19` `1.4.2` `1.4.20` `1.4.21` `1.4.22` `1.4.3` `1.4.4` `1.4.5` `1.4.6` `1.4.7` `1.4.8` `1.4.9` `1.5` `1.5.1` `1.5.10` `1.5.11` `1.5.12` `1.5.2` `1.5.3` `1.5.4` `1.5.5` `1.5.6` `1.5.7` `1.5.8` `1.5.9` `1.6` `1.6.1` `1.6.10` `1.6.11` `1.6.2` `1.6.3` `1.6.4` `1.6.5` `1.6.6` `1.6.7` `1.6.8` `1.6.9` `1.7` `1.7.1` `1.7.10` `1.7.11` `1.7.2` `1.7.3` `1.7.4` `1.7.5` `1.7.6` `1.7.7` `1.7.8` `1.7.9` `1.8` `1.8.1` `1.8.10` `1.8.11` `1.8.12` `1.8.13` `1.8.14` `1.8.15` `1.8.2` `1.8.3` `1.8.4` `1.8.5` `1.8.6` `1.8.7` `1.8.8` `1.8.9` `1.8a1` `1.8b1` `1.8b2` `1.8c1` `1.9` `1.9.1` `1.9.10` `1.9.2` `1.9.3` `1.9.4` `1.9.5` `1.9.6` `1.9.7` `1.9.8` `1.9.9`

Description

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

PYSEC-2016-18

Affected versions

django PyPI

Description

References