Denial-of-Service Vulnerability in Django Framework
CVE-2026-15337
What is CVE-2026-15337?
A potential denial-of-service vulnerability has been identified in Django versions 5.2 prior to 5.2.17 and 6.0 prior to 6.0.8. This issue arises when the function django.utils.translation.check_for_language() is exposed to many distinct and excessively long language codes. These codes are stored as keys in an in-memory cache, which can lead to significant memory consumption. The problematic language codes reach this function through the django.views.i18n.set_language() view that is not enabled by default. While the memory usage is constrained by the DATA_UPLOAD_MAX_MEMORY_SIZE (default set to 2.5 MB) and a fixed cache size, the potential for denial of service remains. Earlier unsupported versions, such as 5.1.x, 5.0.x, and 4.2.x, were not specifically evaluated for this vulnerability and may also be vulnerable.
Affected Version(s)
Django 6.0 < 6.0.8
Django 5.2 < 5.2.17
Django 6.0.8