CVE-2016-9014

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

• CWE-264

• http://www.debian.org/security/2017/dsa-3835
• http://www.securityfocus.com/bid/94068Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037159Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-3115-1Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
• https://www.djangoproject.com/weblog/2016/nov/01/security-releases/Release Notes, Vendor Advisory
• http://www.debian.org/security/2017/dsa-3835
• http://www.securityfocus.com/bid/94068Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037159Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-3115-1Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
• https://www.djangoproject.com/weblog/2016/nov/01/security-releases/Release Notes, Vendor Advisory

Published

Dec 9, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9008IBM UrbanCode Deploy could allow a malicious user to access …
• CVE-2016-9009IBM WebSphere MQ 8.0 could allow an authenticated user with …
• CVE-2016-9010IBM WebSphere Message Broker 9.0 and 10.0 could allow a remo…
• CVE-2016-9011The wmf_malloc function in api.c in libwmf 0.2.8.4 allows re…
• CVE-2016-9012CloudVision Portal (CVP) before 2016.1.2.1 allows remote aut…
• CVE-2016-9013Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x …
• CVE-2016-9015Versions 1.17 and 1.18 of the Python urllib3 library suffer …
• CVE-2016-9016Firejail 0.9.38.4 allows local users to execute arbitrary co…
• CVE-2016-9017Artifex Software, Inc. MuJS before a5c747f1d40e8d6659a37a8d2…
• CVE-2016-9018Improper handling of a repeating VRAT chunk in qcpfformat.dl…
• CVE-2016-9019SQL injection vulnerability in the activate_address function…
• CVE-2016-9020SQL injection vulnerability in framework/modules/help/contro…