~ / search / GHSA-jh3w-4vvf-mjgr

GHSA-jh3w-4vvf-mjgr

Django has regular expression denial of service vulnerability in EmailValidator/URLValidator

Source: GitHub Advisory Database (reviewed) High CVE-2023-36053

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 3.2a1, < 3.2.20 3.2.20
PyPI Django >= 4.0a1, < 4.1.10 4.1.10
PyPI Django >= 4.2a1, < 4.2.3 4.2.3

Details

As written in the advisory (Markdown source, shown as plain text).

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, `EmailValidator` and `URLValidator` are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

References

External links from the advisory. They lead to third-party sites.