CVE-2024-39614: Django Denial-of-Service Vulnerability in get_supported_language_variant()
Summary
CVE-2024-39614: An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Affects django across 2 version ranges.
>= 4.2.0, < 4.2.14
>= 5.0.0, < 5.0.7
Fixed in 4.2.14 or 5.0.7, depending on the release line you run. How to fix ↓
Also tracked for
- django · PyPI
- python-django · Debian:11
- django · PyPI
The same CVE-2024-39614 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, and templating. However, certain functions within Django can be exploited if not properly managed, leading to potential security risks.
Vulnerability Detail
An issue was discovered in Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14, where the function get_supported_language_variant() is vulnerable to a denial-of-service attack. This vulnerability arises when the function processes very long strings containing specific characters, which can lead to excessive resource consumption and potentially crash the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.144.2.14 -
>= 5.0.0, < 5.0.75.0.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot immediately update Django, consider implementing input validation to restrict the length and content of strings passed to the get_supported_language_variant() function. This can help mitigate the risk of denial-of-service attacks.
Conclusion
The CVE-2024-39614 vulnerability in Django poses a significant risk of denial-of-service attacks through the get_supported_language_variant() function. It is crucial for developers to update their Django installations to the latest patched versions to mitigate this risk.
See every vulnerability recorded for django →
FAQ
CVE-2024-39614 is a vulnerability in Django that allows for a potential denial-of-service attack through the get_supported_language_variant() function.
Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to denial-of-service conditions, causing the application to become unresponsive or crash.
You can report this vulnerability through the appropriate channels, such as the Django project's issue tracker on GitHub.
Related vulnerabilities
Recent vulnerabilities recorded for django.
