CVE-2016-9014

—

CVSS 3.0

8.1 high

EPSS

6%p93

Published

Dec 9, 2016 (Dec 9, 2016)

Modified

Jun 17, 2026

Description

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

Vendors: fedoraproject canonical djangoproject
Products: fedora, ubuntu linux, django
Weakness: CWE-264
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (6.1%)

In the news0 stories

No ingested article mentions this CVE yet.