CVE-2024-27351: Denial-of-Service Vulnerability in Django
Summary
CVE-2024-27351: In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expressi... Affects django across 3 version ranges.
>= 3.2, < 3.2.25
>= 4.2, < 4.2.11
>= 5.0, < 5.0.3
Fixed in 3.2.25, 4.2.11 or 5.0.3, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2024-27351 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and versatility. It provides developers with a set of tools and libraries to build web applications efficiently. However, Django versions 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3 are susceptible to a denial-of-service vulnerability. This vulnerability affects the django.utils.text.Truncator.words() method and the truncatewords_html template filter when used with the html=True parameter.
Vulnerability Detail
The vulnerability in Django arises due to an incomplete fix for previous vulnerabilities, namely CVE-2019-14232 and CVE-2023-43665. An attacker can exploit this vulnerability by providing a crafted string that triggers a regular expression denial-of-service attack. This attack can lead to resource exhaustion and potentially disrupt the availability of the affected Django application. It is important to note that this vulnerability can be exploited even if the application has already applied the fixes for the aforementioned CVEs.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.2, < 3.2.253.2.25pip install --upgrade "django==3.2.25" -
>= 4.2, < 4.2.114.2.11pip install --upgrade "django==4.2.11" -
>= 5.0, < 5.0.35.0.3pip install --upgrade "django==5.0.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can avoid using the django.utils.text.Truncator.words() method with the html=True parameter and refrain from using the truncatewords_html template filter. By removing or replacing these components in the code, the vulnerability can be mitigated. Here's an example of how to truncate words without using the vulnerable components:
from django.utils.text import Truncator
truncated_text = Truncator(text).words(num_words=20, html=False)
Conclusion
In conclusion, Django versions 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3 are vulnerable to a denial-of-service attack. This vulnerability can be mitigated by upgrading Django to the fixed versions or by avoiding the usage of the vulnerable components. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability can be exploited to launch a denial-of-service attack, potentially causing resource exhaustion and disrupting the availability of the affected Django application.
No, only Django versions 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3 are vulnerable to this issue.
Yes, an attacker can exploit this vulnerability remotely by sending a specially crafted string to the affected Django application.
At the time of this report, there is no known public exploit for this vulnerability.
No, this vulnerability can be exploited even if the previous fixes have been applied. It is crucial to upgrade to the fixed versions mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for django.
