Django Vulnerability: Potential Denial of Service Attack via URL
CVE-2024-38875

7.5HIGH

Key Information:

Vendor

Django

Status
Django
Vendor
CVE Published:
10 July 2024

What is CVE-2024-38875?

A potential denial of service vulnerability has been identified in Django versions prior to 4.2.14 and 5.0.7. This issue arises from the urlize and urlizetrunc functions, which may be exploited by inputs comprising an excessively high number of brackets. Attackers can leverage this flaw to disrupt service, prompting the need for swift updates to mitigate the risk.

References

https://docs.djangoproject.com/en/dev/releases/security/
https://groups.google.com/forum/#%21forum/django-announce
https://www.djangoproject.com/weblog/2024/jul/09/security...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.