CVE-2025-32873: Django Denial-of-Service Vulnerability in strip_tags Function
Summary
CVE-2025-32873: An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. Affects django across 2 version ranges.
>= 4.2.0, < 5.0.3
>= 5.1.0, < 5.2.1
Fixed in 5.0.3 or 5.2.1, depending on the release line you run. How to fix ↓
Also tracked for
- django · PyPI
- django · PyPI
- python-django · Debian:11
The same CVE-2025-32873 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features, including an ORM, authentication, and templating. The framework is designed to help developers create secure and maintainable applications. However, certain versions of Django are vulnerable to performance issues when processing large sequences of incomplete HTML tags, particularly through the strip_tags function.
Vulnerability Detail
An issue was discovered in Django versions 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The vulnerability lies in the django.utils.html.strip_tags() function, which can lead to a denial-of-service condition due to slow performance when handling inputs with extensive incomplete HTML tags. This can significantly degrade the performance of applications using this function, especially if the input is controlled by an attacker.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 5.0.35.0.3 -
>= 5.1.0, < 5.2.15.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the input size for the strip_tags function to prevent processing excessively large inputs. For example, you can implement a check before calling the function: if len(input_string) < MAX_SIZE: result = strip_tags(input_string) else: raise ValueError('Input too large to process')
Conclusion
The CVE-2025-32873 vulnerability in Django's strip_tags function poses a significant risk of denial-of-service due to slow performance with specific inputs. It is crucial for developers to update to the patched versions of Django to ensure the security and performance of their applications. Utilizing tools like Vulert can help monitor and manage such vulnerabilities effectively.
See every vulnerability recorded for django →
FAQ
Django versions 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1 are affected.
The vulnerability can lead to denial-of-service conditions, causing slow performance in applications that process large sequences of incomplete HTML tags.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Yes, the vulnerability is patched in Django versions 5.0.3 and later. It is recommended to upgrade to these versions.
If an immediate upgrade is not possible, consider implementing input size checks as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for django.
