Memory Consumption Vulnerability in Django Package: CVE-2024-41989
Summary
CVE-2024-41989: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects python-django versions >= 879e5d587b84e6fc961829611999431778eb9f6a, < 4d32ebcd57340aa8de2d6d31613f1646dc6391f6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and an admin interface. The framework is widely used for its scalability and security features. However, certain versions of Django are vulnerable to a memory consumption issue when using the floatformat template filter with large exponent scientific notation.
Vulnerability Detail
CVE-2024-41989 is a vulnerability found in Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15. The issue arises when the floatformat template filter processes a string representation of a number in scientific notation with a large exponent, leading to significant memory consumption. This can result in denial of service as the application may exhaust available memory, causing it to crash or become unresponsive. The vulnerability affects multiple Debian ecosystems and can be exploited without authentication.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the floatformat template filter with large exponent scientific notation until you can upgrade to a secure version of Django.
Conclusion
CVE-2024-41989 presents a significant risk to applications using vulnerable versions of Django, particularly in terms of memory consumption. It is crucial to upgrade to the latest secure versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-django →
FAQ
CVE-2024-41989 is a vulnerability in Django that causes high memory consumption when processing certain scientific notation inputs with the floatformat template filter.
Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2024-41989 is 7.5, indicating a high severity level.
If you cannot upgrade immediately, avoid using the floatformat template filter with large exponent scientific notation as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
