Django vulnerable to Allocation of Resources Without Limits or Throttling
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-26699US | high7.5 | — | ||
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a pote… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2025/03/06/12WEB
- https://docs.djangoproject.com/en/dev/releases/securityWEB
- https://github.com/django/djangoPACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-13.yamlWEB
- https://groups.google.com/g/django-announceWEB
- https://lists.debian.org/debian-lts-announce/2025/03/msg00012.htmlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-26699ADVISORY
- https://www.djangoproject.com/weblog/2025/mar/06/security-releasesWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan