PT-2024-1785 · Django+6 · Django+6
Seokchan Yoon
·
Published
2024-02-06
·
Updated
2026-01-03
·
CVE-2024-24680
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 3.2 before 3.2.24
Django versions 4.2 before 4.2.10
Django versions 5.0 before 5.0.2
Description
The issue is related to a potential denial-of-service attack when the intcomma template filter is used with very long strings. This could allow a remote attacker to cause a denial of service. The vulnerability is associated with uncontrolled resource consumption.
Recommendations
For Django versions 3.2 before 3.2.24, update to version 3.2.24 or later to resolve the issue.
For Django versions 4.2 before 4.2.10, update to version 4.2.10 or later to resolve the issue.
For Django versions 5.0 before 5.0.2, update to version 5.0.2 or later to resolve the issue.
As a temporary workaround, consider avoiding the use of the intcomma template filter with very long strings until a patch is available.
Fix
Improper Resource Release
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Django
Linuxmint
Red Os
Ubuntu