Denial-of-Service Vulnerability in Django Package: CVE-2024-41991
Summary
CVE-2024-41991: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects python-django versions >= 879e5d587b84e6fc961829611999431778eb9f6a, < 4d32ebcd57340aa8de2d6d31613f1646dc6391f6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features including an ORM, authentication, and an admin interface. The framework is designed to help developers create secure and maintainable applications. However, certain versions of Django are vulnerable to a denial-of-service attack due to improper handling of inputs with a large number of Unicode characters.
Vulnerability Detail
CVE-2024-41991 affects Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15. The vulnerability arises from the urlize and urlizetrunc template filters, as well as the AdminURLFieldWidget widget, which can be exploited by providing inputs containing a very large number of Unicode characters. This can lead to a denial-of-service condition, where the application may become unresponsive or crash, impacting availability for users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to restrict the number of Unicode characters allowed in user inputs. This can be done by modifying your form validation logic to limit the length of input fields that utilize the urlize and urlizetrunc filters.
Conclusion
CVE-2024-41991 is a significant vulnerability in Django that can lead to denial-of-service attacks. It is crucial for developers using affected versions to upgrade to the latest secure releases to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until an upgrade can be performed.
See every vulnerability recorded for python-django →
FAQ
CVE-2024-41991 is a vulnerability in Django that can lead to denial-of-service attacks through specific inputs with excessive Unicode characters.
Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2024-41991 is 7.5, indicating a high severity level.
If immediate upgrading is not possible, implement input validation to limit the number of Unicode characters in user inputs as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
