GHSA-qg2p-9jwr-mmqf

Django vulnerable to Denial of Service

Source: GitHub Advisory Database (reviewed) High CVE-2024-38875

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Django	>= 4.2, < 4.2.14	4.2.14
PyPI	Django	>= 5.0, < 5.0.7	5.0.7

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-38875 advisory
https://github.com/django/django/commit/7285644640f085f41d60ab0c8ae4e9153f0485db web
https://github.com/django/django/commit/79f368764295df109a37192f6182fb6f361d85b5 web
https://docs.djangoproject.com/en/dev/releases/security web
https://github.com/django/django package
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-56.yaml web
https://groups.google.com/forum/#%21forum/django-announce web
https://security.netapp.com/advisory/ntap-20240808-0005 web
https://www.djangoproject.com/weblog/2024/jul/09/security-releases web