GoogleOSV:GHSA-F6F8-9MX6-9MX2Django vulnerable to Denial of Service
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
Low
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.
References
docs.djangoproject.com/en/dev/releases/security
github.com/django/django
github.com/django/django/commit/17358fb35fb7217423d4c4877ccb6d1a3a40b1c3
github.com/django/django/commit/8e7a44e4bec0f11474699c3111a5e0a45afe7f49
github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-59.yaml
groups.google.com/forum/#%21forum/django-announce
nvd.nist.gov/vuln/detail/CVE-2024-39614
www.djangoproject.com/weblog/2024/jul/09/security-releases
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
Low