Denial-of-Service Vulnerability in Django 5.0 and 4.2: get_supported_language_variant() Affected
Summary
CVE-2024-39614: An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Affects python-django versions >= 879e5d587b84e6fc961829611999431778eb9f6a, < 98cf264c9cb0561e4ec305a621e9d58116e44aef. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and a templating engine. The framework is widely used for its scalability and security features. However, certain versions of Django are vulnerable to a denial-of-service attack due to improper handling of long strings in the get_supported_language_variant() function.
Vulnerability Detail
An issue was discovered in Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14, where the get_supported_language_variant() function could be exploited through very long strings containing specific characters. This vulnerability could lead to a denial-of-service condition, potentially causing the application to become unresponsive or crash. The root cause lies in the function's inability to handle excessively long input strings, which can be crafted by an attacker to disrupt service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing input validation to limit the length of strings passed to the get_supported_language_variant() function. For example, you can add a check in your code:
if len(input_string) > MAX_LENGTH: raise ValueError('Input string is too long.')
This will help mitigate the risk until the framework can be updated.
Conclusion
The vulnerability in Django's get_supported_language_variant() function poses a significant risk of denial-of-service attacks in specific versions. It is crucial for developers using affected versions to update their installations promptly and consider implementing input validation as a temporary measure. Tools like Vulert can assist in monitoring and alerting for such vulnerabilities in real-time.
See every vulnerability recorded for python-django →
FAQ
Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14 are affected.
The vulnerability can lead to a denial-of-service condition, causing the application to become unresponsive or crash.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, implementing input validation to limit the length of strings passed to the affected function can help mitigate the risk.
More information can be found in the CVE details and related advisories, such as USN-6888-1 and USN-6888-2.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
