CVE-2011-4139: Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in cer...

Security readout for executives and security teams

This flaw affects older Django releases that trusted the HTTP Host header when building full URLs. A remote attacker could craft requests that influence cached content, creating a cache poisoning risk for affected Django applications behind shared caches or proxies. Exposure is most likely in legacy Django 1.2 or 1.3 applications, especially those using shared HTTP caches, reverse proxies, or CDN caching where Host-derived absolute URLs may be cached. Treat this as a legacy exposure cleanup item with moderate urgency. It is old and not KEV-listed, but affected internet-facing Django applications behind caches could serve attacker-influenced cached content. Mitigation focus: Upgrade Django to 1.2.7, 1.3.1, or a supported later release.; Apply distribution security updates from Debian, openSUSE, or the relevant package vendor.; Review vendor advisories before relying on configuration-only mitigations..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.