PT-2025-9994 · Django+6 · Django+6

Sw0Rd1Ight · CVE-2025-26699 · Published 2025-03-06 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.19 Django versions 5.0 through 5.0.12 Django versions 5.1 through 5.1.6

Description A potential denial-of-service attack can occur when the django.utils.text.wrap() method and wordwrap template filter are used with very long strings.

Recommendations For Django versions 4.2 through 4.2.19, update to version 4.2.20 or later. For Django versions 5.0 through 5.0.12, update to version 5.0.13 or later. For Django versions 5.1 through 5.1.6, update to version 5.1.7 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-770

CWE-20

Related Identifiers

ALT-PU-2025-10176

ALT-PU-2025-4236

BDU:2025-08558

BDU:2025-08584

BIT-DJANGO-2025-26699

CVE-2025-26699

DLA-4086-1

GHSA-P3FP-8748-VQFQ

MGASA-2025-0095

OESA-2025-1260

OPENSUSE-SU-2025:14908-1

OPENSUSE-SU-2025:14913-1

OPENSUSE-SU-2025_0959-1

OPENSUSE-SU-2026:10005-1

OPENSUSE-SU-2026:11270-1

PYSEC-2025-13

RHSA-2025:3160

RHSA-2025:4553

RHSA-2025:8609

SUSE-SU-2025:0959-1

USN-7335-1

Affected Products

Alt Linux

Debian

Django

Linuxmint

Red Os

Suse

Ubuntu

References · 143

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26699.json · Exploit
• https://ubuntu.com/security/notices/USN-7501-2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08584 · Security Note
• https://djangoproject.com/weblog/2025/mar/06/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-26699 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11270-1 · Vendor Advisory
• https://groups.google.com/g/django-announce · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26699 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-13 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-26699 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4086-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p3fp-8748-vqfq · Vendor Advisory
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08558 · Security Note
• https://ubuntu.com/security/notices/USN-7335-1 · Vendor Advisory