PT-2024-6154 · Django+5 · Django+5
Elias Myllymäki
·
Published
2024-07-31
·
Updated
2026-01-03
·
CVE-2024-41989
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.14
Django versions 5.0 through 5.0.7
Description
The issue is related to the
floatformat() function in Django, which can lead to uncontrolled resource consumption. This can be exploited by a remote attacker to cause a denial of service. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.Recommendations
For Django versions 4.2 through 4.2.14, update to version 4.2.15 or later.
For Django versions 5.0 through 5.0.7, update to version 5.0.8 or later.
As a temporary workaround, consider restricting the use of the
floatformat template filter to minimize the risk of exploitation. Avoid using the floatformat filter with input strings that contain large exponents in scientific notation until the issue is resolved.Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Django
Linuxmint
Ubuntu