CVE-2021-44420: Canonical Ubuntu Linux

High severity, CVSS 7.3. EPSS: 2.5% chance of exploitation in the next 30 days.

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

Affected products

• Canonical Ubuntu Linux: version 20.04 only; version 21.04 only; version 21.10 only
• Debian Debian Linux: version 10.0 only; version 11.0 only
• Djangoproject Django: from 2.2, before 2.2.25 (fixed in 2.2.25); from 3.1, before 3.1.14 (fixed in 3.1.14); from 3.2, before 3.2.10 (fixed in 3.2.10)
• Fedoraproject Fedora: version 35 only
• Red Hat Satellite: version 6.0 only

Published 2021-12-08. Last modified 2026-06-17.