CVE-2024-27351

2024-03-1500:00:00

mitre

github.com

django

denial-of-service

truncatewords

cve-2024-27351

AI Score

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:django-rest-framework:django_rest_framework:*:*:*:*:*:*:*:*"
    ],
    "vendor": "django-rest-framework",
    "product": "django_rest_framework",
    "versions": [
      {
        "status": "affected",
        "version": "5.0",
        "lessThan": "5.0.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]