CVE-2016-9014

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2017/dsa-3835
http://www.securityfocus.com/bid/94068Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037159Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3115-1Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
https://www.djangoproject.com/weblog/2016/nov/01/security-releases/Release Notes, Vendor Advisory
http://www.debian.org/security/2017/dsa-3835
http://www.securityfocus.com/bid/94068Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037159Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3115-1Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
https://www.djangoproject.com/weblog/2016/nov/01/security-releases/Release Notes, Vendor Advisory

Timeline

Published: Dec 9, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-90153.7Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not corr CVE-2016-90168.8Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.CVE-2016-90177.5Artifex Software, Inc. MuJS before a5c747f1d40e8d6659a37a8d25f13fb5acf8e767 allows context-dependent attackers to obtain sensitive informati CVE-2016-90185.5Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and crash in RealNetworks CVE-2016-90199.8SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CVE-2016-90209.8SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attacke CVE-2016-90219.8Exponent CMS before 2.6.0 has improper input validation in storeController.php.CVE-2016-90229.8Exponent CMS before 2.6.0 has improper input validation in usersController.php.CVE-2016-90239.8Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.CVE-2016-90259.8Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.CVE-2016-90269.8Exponent CMS before 2.6.0 has improper input validation in fileController.php.CVE-2016-90288.8Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote