PT-2024-6225 · Django+6 · Django+6
Elias Myllymäki
·
Published
2024-06-21
·
Updated
2026-01-03
·
CVE-2024-38875
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.13
Django versions 5.0 through 5.0.6
Description
The issue is related to a potential denial of service attack via certain inputs with a very large number of brackets in the
urlize and urlizetrunc functions. This can cause uncontrolled resource consumption due to poor time complexity of strip punctuation. The vulnerability may allow a remote attacker to cause a denial of service.Recommendations
For Django versions 4.2 through 4.2.13, update to version 4.2.14 or later.
For Django versions 5.0 through 5.0.6, update to version 5.0.7 or later.
As a temporary workaround, consider restricting the use of the
urlize and urlizetrunc functions until a patch is available. Avoid using these functions with untrusted input to minimize the risk of exploitation.Fix
DoS
Allocation of Resources Without Limits
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Django
Linuxmint
Suse
Ubuntu