CVE-2024-39614

highpriority · track · 20EPSS 0.286 · 98 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

28.6% (98th) EPSS

CVSS 7.5 · high

Is it mine?

153 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedansible-automation-platform-24/lightspeed-rhel8@sha256:12c4d12458de0cbe104312b728255af4aa28174737b790a87b295395846e0a90_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8redhat_csaf
Red Hat Ansible Automation Platform
https://access.redhat.com/errata/RHBA-2024:6429
Fixedansible-automation-platform-24/lightspeed-rhel8@sha256:3fe380543ec14ef56d71df12828bc24a562af62603009a9545bb057a3fb39481_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8redhat_csaf
Red Hat Ansible Automation Platform
https://access.redhat.com/errata/RHBA-2024:6429
Fixedansible-automation-platform-24/lightspeed-rhel8@sha256:41c3d0b0698552ff08674f88c3b91f8cba1df2e76c4f327e921fb0bee5a561f9_ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8redhat_csaf
Red Hat Ansible Automation Platform
https://access.redhat.com/errata/RHBA-2024:6429
Fixedansible-automation-platform-24/lightspeed-rhel8@sha256:af52ccfd6124927185d9d2e8a0ea28f363a5f8e0c14a29759bc276ae341b048c_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8redhat_csaf
Red Hat Ansible Automation Platform
https://access.redhat.com/errata/RHBA-2024:6429
Fixedpython312-Django6-0:6.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython312-Django6-0:6.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython312-Django6-0:6.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython312-Django6-0:6.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython313-Django6-0:6.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython313-Django6-0:6.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython313-Django6-0:6.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython313-Django6-0:6.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.3–7.5

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · SUSE Product Security

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · Red Hat Product Security US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1287USCWE-130USCWE-130USCWE-130USCWE-770US

exploits (1)

Public proof-of-concept and weaponised exploit code.

Abdurahmon3236/-CVE-2024-39614Abdurahmon3236/-CVE-2024-39614PoC · poc_in_github

affected products (153)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
Open Source Django <4.2.14all versionscert_bundDE
Open Source Django <5.0.7all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Update Infrastructure 4all versionscert_bundDEcpe:/o:redhat:enterprise_linux:update_infrastructure_4
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Xerox FreeFlow Print Server v9 for Solarisall versionscert_bundDEcpe:/a:xerox:freeflow_print_server:v9_for_solaris
Open Source Django< 4.2.14cert_bundDE
Open Source Django< 5.0.7cert_bundDE
n/a n/a≤ n/aenisa_euvdEU
Django Software Foundation Django≤ 4.2.14fstec_bduRU
Django Software Foundation Django5.0 → 5.0.7fstec_bduRU
АО «НППКТ» ОСОН ОСнова 3 Оnyx≤ 3.2fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.15fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.6 «Смоленск»fstec_bduRU

showing 20 of 153

advisories (6)

Vendor and ecosystem advisories describing this.

RHBA-2024:6429Red Hat Bug Fix Advisory: Red Hat Ansible Automation Platform 2.4 Container Release Update2024-09-05csaf · redhat_csafUS
An update is now available for Red Hat Ansible Automation Platform 2.4
WID-SEC-W-2024-1569Django: Mehrere SchwachstellenDeutsch2024-07-09csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.
openSUSE-SU-2026:10005-1python312-Django6-6.0-1.1 on GA media2026-01-03csaf · suse_csafDE
python312-Django6-6.0-1.1 on GA media
GHSA-f6f8-9mx6-9mx2Django vulnerable to Denial of Service2024-07-10ghsa · osvUS
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. `get_supported_language_variant()` was subject to a potential denial-of-service attack when used with very long strings containing specific characters.
BIT-django-2024-396142025-03-10vendor · osvUS
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.
PYSEC-2024-592024-07-10vendor · osvUS
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

also known as (8)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund redhat_csaf suse_csaf NVD CVE.org MITRE

published 2024-07-10modified 2026-09-23

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan