GHSA-jh75-99hh-qvx9

Django memory consumption vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-41989

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Django	>= 5.0, < 5.0.8	5.0.8
PyPI	Django	>= 4.2, < 4.2.15	4.2.15

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-41989 advisory
https://github.com/django/django/commit/27900fe56f3d3cabb4aeb6ccb82f92bab29073a8 web
https://github.com/django/django/commit/fc76660f589ac07e45e9cd34ccb8087aeb11904b web
https://docs.djangoproject.com/en/dev/releases/security web
https://github.com/django/django package
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-67.yaml web
https://groups.google.com/forum/#%21forum/django-announce web
https://security.netapp.com/advisory/ntap-20240905-0007 web
https://www.djangoproject.com/weblog/2024/aug/06/security-releases web