CVE-2021-45115: Denial-of-service in Django
Summary
CVE-2021-45115: Denial-of-service in Django. Affects django across 3 version ranges.
>= 2.2a1, < 2.2.26
>= 3.2a1, < 3.2.11
>= 4.0a1, < 4.0.1
Fixed in 2.2.26, 3.2.11 or 4.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2021-45115 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for developing robust and scalable web applications. It provides a wide range of features and tools to simplify the development process. However, Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 are vulnerable to a denial-of-service attack. This vulnerability arises from the UserAttributeSimilarityValidator, which incurs significant overhead when evaluating a submitted password that is artificially large compared to the comparison values. If user registration is unrestricted, this vulnerability can be exploited to launch a denial-of-service attack.
Vulnerability Detail
The vulnerability (CVE-2021-45115) in Django allows an attacker to exploit the UserAttributeSimilarityValidator to cause a denial-of-service condition. By submitting a password that is artificially large, the validator incurs significant overhead during the evaluation process. This vulnerability can be exploited when user registration is unrestricted, providing an avenue for a potential denial-of-service attack. The impact of this vulnerability can be severe, as it can lead to service disruption and unavailability.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2a1, < 2.2.262.2.26pip install --upgrade "django==2.2.26" -
>= 3.2a1, < 3.2.113.2.11pip install --upgrade "django==3.2.11" -
>= 4.0a1, < 4.0.14.0.1pip install --upgrade "django==4.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by restricting user registration or implementing rate limiting mechanisms. By limiting the number of registration attempts or the rate at which requests are processed, the impact of a potential denial-of-service attack can be mitigated. However, this workaround may affect the user experience and should only be considered as a temporary solution until the upgrade can be performed.
Conclusion
The vulnerability (CVE-2021-45115) in Django exposes the UserAttributeSimilarityValidator to a denial-of-service attack. Upgrading Django to the patched versions is the recommended solution to mitigate this vulnerability. If immediate upgrade is not possible, implementing temporary workarounds such as user registration restrictions or rate limiting can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies the development of web applications by providing a high-level API and a set of tools and features.
The vulnerability allows an attacker to launch a denial-of-service attack, leading to service disruption and unavailability.
To fix this vulnerability, upgrade Django to version 2.2.26, 3.2.11, or 4.0.1. Thoroughly test the application after the upgrade.
A temporary workaround is to restrict user registration or implement rate limiting mechanisms to mitigate the impact of a potential attack.
Upgrading Django is the recommended solution. However, if immediate upgrade is not feasible, implementing rate limiting mechanisms can provide temporary mitigation.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
