CVE-2024-39614: Django - Denial-of-Service Vulnerability
Summary
CVE-2024-39614: An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Affects django across 2 version ranges.
>= 4.2, < 4.2.14
>= 5.0, < 5.0.7
Fixed in 4.2.14 or 5.0.7, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2024-39614 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building scalable and secure web applications. It provides a wide range of features and tools to simplify the development process. However, Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14 are susceptible to a denial-of-service vulnerability. This vulnerability affects the 'get_supported_language_variant()' function when used with very long strings containing specific characters.
Vulnerability Detail
The 'get_supported_language_variant()' function in Django can be exploited by an attacker to launch a denial-of-service attack. By providing a specially crafted long string as input, an attacker can cause the function to consume excessive resources, leading to a system slowdown or unresponsiveness. This vulnerability can be triggered by an unauthenticated attacker and may result in service disruption or downtime.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.144.2.14pip install --upgrade "django==4.2.14" -
>= 5.0, < 5.0.75.0.7pip install --upgrade "django==5.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and limit the length of user-provided strings before passing them to the 'get_supported_language_variant()' function. By enforcing a reasonable limit on the input length, the impact of the vulnerability can be minimized. Here's an example of how to limit the input length in Python:
input_string = input_string[:100] # Limit input to 100 characters
Conclusion
The denial-of-service vulnerability in Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14 can be exploited by an attacker to cause service disruption or downtime. It is crucial to update Django to the fixed versions (5.0.7 or 4.2.14) to mitigate the risk. Additionally, implementing input validation and limiting the length of user-provided strings can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for django →
FAQ
This vulnerability can be exploited by an attacker to launch a denial-of-service attack, potentially causing service disruption or downtime.
Yes, this vulnerability can be exploited remotely by an unauthenticated attacker.
No, only Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14 are affected. It is recommended to upgrade to the fixed versions.
Yes, developers can implement input validation and limit the length of user-provided strings to mitigate the impact of the vulnerability.
You can update Django by using the package manager or manually downloading and installing the updated version (5.0.7 or 4.2.14).
Related vulnerabilities
Recent vulnerabilities recorded for django.
