A critical header spoofing vulnerability in the Django web framework allows unauthenticated attackers to manipulate request headers, potentially bypassing security controls.

This vulnerability, identified as CWE-290, stems from an ambiguous mapping of header variants within the ASGIRequest component. An unauthenticated remote attacker can exploit this discrepancy to spoof headers, which may lead to authentication bypass or the subversion of application logic that relies on specific header values.

The ability to spoof HTTP headers carries significant risk for enterprise applications that use these headers for security decisions, such as identifying the client IP, determining authorization roles, or enforcing access control policies. Given the CVSS score of 7.5, this high-severity flaw could lead to unauthorized access to sensitive data or administrative functions. The impact is compounded by the fact that the vulnerability is remotely exploitable without authentication, making it an attractive target for automated scanning and exploitation.

Immediate Action: Upgrade Django to versions 6.0.4, 5.2.13, or 4.2.30 immediately to incorporate the necessary header normalization logic.

Proactive Monitoring: Monitor web server logs for anomalous header patterns or requests containing both hyphenated and underscored versions of the same header name, which may indicate probing activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to normalize incoming HTTP headers and drop requests that contain conflicting or ambiguous header definitions.

Public Exploit Available: Unknown

Organizations utilizing the Django framework must prioritize patching their environments to the specified secure versions. Because this vulnerability affects the core request handling mechanism, it is essential to verify that all deployed instances, including legacy environments, are updated or appropriately mitigated to prevent unauthorized access via header manipulation.