Denial-of-Service Vulnerability in Django Package: CVE-2025-26699
Summary
CVE-2025-26699: An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. Affects python-django versions < 2:2.2.28-1~deb11u6. Fixed in 2:2.2.28-1~deb11u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and offers a range of features including an ORM, routing, and templating. The vulnerability CVE-2025-26699 affects Django versions 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20, specifically in the django.utils.text.wrap() method and the wordwrap template filter, which can be exploited with very long strings.
Vulnerability Detail
CVE-2025-26699 is a potential denial-of-service (DoS) vulnerability that arises when the django.utils.text.wrap() method and the wordwrap template filter are used with excessively long strings. This can lead to resource exhaustion, causing the application to become unresponsive. The vulnerability is present in multiple versions of Django, making it critical for developers to address it promptly.
How To Fix
Minimum fixed version
2:2.2.28-1~deb11u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the django.utils.text.wrap() method and the wordwrap template filter with untrusted or user-generated input. Implement input validation to restrict the length of strings processed by these methods.
Conclusion
CVE-2025-26699 poses a significant risk to applications using vulnerable versions of Django. It is crucial to update to the latest patched versions and implement workarounds to mitigate the risk of denial-of-service attacks. Regular monitoring and vulnerability assessments using tools like Vulert can help maintain application security.
See every vulnerability recorded for python-django →
FAQ
CVE-2025-26699 is a vulnerability in Django that can lead to denial-of-service attacks when using certain text processing methods with long strings.
Django versions 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, implement input validation to limit the length of strings processed by the vulnerable methods as a temporary workaround.
More information can be found in the official CVE database and security advisories related to Django.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
