CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-26699 – django: Potential denial-of-service vulnerability in django.utils.text.wrap()
https://notcve.org/view.php?id=CVE-2025-26699
06 Mar 2025 — An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings. A potential denial of service vulnerability exists in django.utils.text.wrap() and the wordwrap template filter. When processing extremely long strings, these functions may cause excessive resource consumption, potentially leading to service disruption. It was discov... • https://docs.djangoproject.com/en/dev/releases/security • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-56374 – django: potential denial-of-service vulnerability in IPv6 validation
https://notcve.org/view.php?id=CVE-2024-56374
14 Jan 2025 — An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.) A flaw was found in the Django framework. • https://docs.djangoproject.com/en/dev/releases/security • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 8%CPEs: 3EXPL: 0CVE-2024-24680 – Django: denial-of-service in ``intcomma`` template filter
https://notcve.org/view.php?id=CVE-2024-24680
06 Feb 2024 — An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings. Se descubrió un problema en Django 3.2 anterior a 3.2.24, 4.2 anterior a 4.2.10 y Django 5.0 anterior a 5.0.2. El filtro de plantilla intcomma estaba sujeto a un posible ataque de denegación de servicio cuando se utilizaba con cadenas muy largas. A vulnerability was found in Django. • https://docs.djangoproject.com/en/5.0/releases/security •
CVSS: 7.8EPSS: 3%CPEs: 3EXPL: 0CVE-2023-46695
https://notcve.org/view.php?id=CVE-2023-46695
02 Nov 2023 — An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. Se descubrió un problema en Django 3.2 anterior a 3.2.23, 4.1 anterior a 4.1.13 y 4.2 anterior a 4.2.7. La normalización de NFKC es lenta en Windows. • https://docs.djangoproject.com/en/4.2/releases/security • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 1%CPEs: 4EXPL: 0CVE-2023-43665 – python-django: Denial-of-service possibility in django.utils.text.Truncator
https://notcve.org/view.php?id=CVE-2023-43665
05 Oct 2023 — In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. En Dja... • http://www.openwall.com/lists/oss-security/2024/03/04/1 • CWE-1284: Improper Validation of Specified Quantity in Input CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.8EPSS: 1%CPEs: 4EXPL: 0CVE-2023-41164 – python-django: Potential denial of service vulnerability in ``django.utils.encoding.uri_to_iri()``
https://notcve.org/view.php?id=CVE-2023-41164
19 Sep 2023 — In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. En Django 3.2 anterior a 3.2.21, 4.1 anterior a 4.1.11 y 4.2 anterior a 4.2.5, django.utils.encoding.uri_to_iri() está sujeto a un posible ataque DoS (denegación de servicio) a través de ciertas entradas con un número muy grande de caracteres Unicode. An uncontrolled resource consum... • https://docs.djangoproject.com/en/4.2/releases/security • CWE-400: Uncontrolled Resource Consumption CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 7.8EPSS: 21%CPEs: 8EXPL: 0CVE-2023-36053 – python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator
https://notcve.org/view.php?id=CVE-2023-36053
03 Jul 2023 — In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs. A regular expression denial of service vulnerability has been found in Django. Email and URL validators are vulnerable to this flaw when processing a very large number of domain name labels of emails and URLs. Red Hat Ansible Automation Platform provides an enterpris... • https://docs.djangoproject.com/en/4.2/releases/security • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 10.0EPSS: 1%CPEs: 6EXPL: 0CVE-2023-31047 – python-django: Potential bypass of validation when uploading multiple files using one form field
https://notcve.org/view.php?id=CVE-2023-31047
03 May 2023 — In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise. A bypass of validation flaw was found in python-django. When uploading multiple files using one form field, an attacker could upload multiple fi... • https://docs.djangoproject.com/en/4.2/releases/security • CWE-20: Improper Input Validation CWE-862: Missing Authorization •