Denial of Service Vulnerability in Django Framework Affecting Specific Versions

CVE-2023-43665

What is CVE-2023-43665?

In specific versions of the Django framework, potential Denial of Service attacks can be executed through the django.utils.text.Truncator's chars() and words() methods. When these methods are invoked with html=True using extremely long or malformed HTML inputs, they may lead to severe resource exhaustion, compromising application availability. This vulnerability specifically impacts the truncatechars_html and truncatewords_html template filters, which rely on the aforementioned methods, making them susceptible to abuse. Owing to an incomplete fix from a prior vulnerability, developers should take immediate action to protect their applications.

References