Denial-of-Service Vulnerability in Django Package: CVE-2024-41990
Summary
CVE-2024-41990: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects python-django versions >= 879e5d587b84e6fc961829611999431778eb9f6a, < 4d32ebcd57340aa8de2d6d31613f1646dc6391f6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and offers features such as an ORM, routing, authentication, and an admin interface. The vulnerability CVE-2024-41990 affects specific versions of Django, making it susceptible to denial-of-service attacks through its urlize() and urlizetrunc() template filters when handling very large inputs with specific character sequences.
Vulnerability Detail
CVE-2024-41990 is a denial-of-service vulnerability found in Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15. The issue arises from the urlize() and urlizetrunc() template filters, which can be exploited by sending large inputs that contain a specific sequence of characters. This can lead to excessive resource consumption, potentially causing the application to become unresponsive. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing input validation to restrict the size and content of inputs passed to the urlize() and urlizetrunc() filters. This can help mitigate the risk of denial-of-service attacks until a proper upgrade is performed.
Conclusion
CVE-2024-41990 poses a significant risk to applications using vulnerable versions of Django. It is crucial for developers to upgrade to the latest secure versions to protect their applications from potential denial-of-service attacks. Implementing input validation can serve as a temporary workaround until an upgrade is possible.
See every vulnerability recorded for python-django →
FAQ
CVE-2024-41990 is a vulnerability in Django that allows for potential denial-of-service attacks through the urlize() and urlizetrunc() template filters.
Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15 are affected by this vulnerability.
Exploitation of this vulnerability can lead to excessive resource consumption, causing the application to become unresponsive.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of CVE-2024-41990 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
