CVE-2010-4535: Django Password Reset Denial of Service
Summary
CVE-2010-4535: Improper date handling in Django. Affects django across 2 version ranges.
< 1.1.3
>= 1.2, < 1.2.4
Fixed in 1.1.3 or 1.2.4, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2010-4535 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and versatility. It provides a robust set of tools and features for building web applications. One of its components is django.contrib.auth, which handles user authentication and authorization. This vulnerability affects Django versions before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1. The password reset functionality in django.contrib.auth does not properly validate the length of a string representing a base36 timestamp. This oversight allows remote attackers to exploit the vulnerability by sending a URL with a large base36 integer, leading to a denial of service attack that consumes excessive resources.
Vulnerability Detail
The vulnerability lies in the password reset functionality of Django's django.contrib.auth module. By not validating the length of a base36 timestamp string, an attacker can craft a malicious URL with a large base36 integer. When this URL is processed by the application, it triggers a denial of service attack, causing the application to consume excessive resources. This can lead to degraded performance or even a complete system outage. The impact of this vulnerability depends on the resources available to the target system and the number of malicious requests received.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.1.31.1.3pip install --upgrade "django==1.1.3" -
>= 1.2, < 1.2.41.2.4pip install --upgrade "django==1.2.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by manually validating the length of the base36 timestamp string in the password reset functionality. This can be done by adding additional checks in the code to ensure that the length of the string is within acceptable limits. Here is an example of how this can be achieved in Python:
from django.contrib.auth.tokens import default_token_generator
def validate_base36_timestamp(timestamp):
MAX_TIMESTAMP_LENGTH = 10
if len(timestamp) > MAX_TIMESTAMP_LENGTH:
raise ValueError('Invalid timestamp')
# Usage example
token = 'abc123'
validate_base36_timestamp(token)
By implementing this workaround, the application will reject URLs with excessively long base36 timestamps, mitigating the risk of a denial of service attack.
Conclusion
The password reset functionality in Django versions before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 is vulnerable to a denial of service attack. Upgrading to a patched version of Django is the recommended solution. If immediate upgrading is not possible, implementing a temporary workaround by validating the length of the base36 timestamp string can mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows remote attackers to launch a denial of service attack on a Django application by sending a specially crafted URL. This can result in resource exhaustion, leading to degraded performance or even a complete system outage.
Django versions before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to a patched version of Django. Upgrading to version 1.1.3 or later, 1.2.4 or later, or any version after 1.3 beta 1 will address the issue.
If immediate upgrading is not possible, a temporary workaround can be implemented by manually validating the length of the base36 timestamp string in the password reset functionality. This can be done by adding additional checks in the code to ensure that the length of the string is within acceptable limits.
No, this vulnerability does not directly lead to data compromise. However, it can cause a denial of service attack, potentially impacting the availability and performance of the affected Django application.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
