PT-2024-6068 · Django+6 · Django+6
Mprogrammer
·
Published
2024-07-05
·
Updated
2026-01-03
·
CVE-2024-39614
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.13
Django versions 5.0 through 5.0.6
Description
The issue is related to the
get supported language variant() function in Django, which can be subject to a potential denial-of-service attack when used with very long strings containing specific characters. This could allow a remote attacker to cause a denial of service.Recommendations
For Django versions 4.2 through 4.2.13, update to version 4.2.14 or later.
For Django versions 5.0 through 5.0.6, update to version 5.0.7 or later.
As a temporary workaround, consider restricting the input to the
get supported language variant() function to prevent very long strings from being processed.Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Django
Linuxmint
Suse
Ubuntu