PT-2025-20317 · Django+6 · Django+6
Elias Myllymäki
·
Published
2025-05-07
·
Updated
2026-01-03
·
CVE-2025-32873
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.20
Django versions 5.1 through 5.1.8
Django versions 5.2 through 5.2.0
Description
An issue was discovered in Django, where the
django.utils.html.strip tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip tags(). This issue can be exploited by attackers to crash servers via malformed HTML.Recommendations
For Django versions 4.2 through 4.2.20, update to version 4.2.21 or later.
For Django versions 5.1 through 5.1.8, update to version 5.1.9 or later.
For Django versions 5.2 through 5.2.0, update to version 5.2.1 or later.
As a temporary workaround, consider disabling the
strip tags() function or restricting the use of the striptags template filter until a patch is available.Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Django
Linuxmint
Red Os
Suse
Ubuntu