Memory Consumption Vulnerability in Django
Summary
CVE-2024-41989: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects django across 2 version ranges.
>= 4.2, < 4.2.15
>= 5.0, < 5.0.8
Fixed in 4.2.15 or 5.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2024-41989 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and versatility. It provides a robust set of tools and features for building web applications. The floatformat template filter in Django is used to format floating-point numbers in templates. This vulnerability affects Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15. When the floatformat filter is given a string representation of a number in scientific notation with a large exponent, it can lead to significant memory consumption.
Vulnerability Detail
The vulnerability in Django's floatformat template filter arises when processing a number in scientific notation with a large exponent. This can result in excessive memory usage, potentially leading to denial-of-service (DoS) attacks. An attacker could exploit this vulnerability by providing a specially crafted input that triggers the excessive memory consumption. The impact of this vulnerability can range from degraded performance to complete system unavailability.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.154.2.15pip install --upgrade "django==4.2.15" -
>= 5.0, < 5.0.85.0.8pip install --upgrade "django==5.0.8"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid using the floatformat template filter with input that includes numbers in scientific notation with large exponents. Instead, it is advisable to preprocess the input and convert it to a more manageable format before applying the floatformat filter. Here's an example of a workaround in Python code:
# Preprocess the input
def preprocess_input(number):
# Convert scientific notation to decimal notation
return str(float(number))
# Apply the floatformat filter
preprocessed_number = preprocess_input(number)
formatted_number = floatformat(preprocessed_number)
Conclusion
The memory consumption vulnerability in Django's floatformat template filter can lead to significant resource usage and potential denial-of-service attacks. It is crucial to upgrade to the fixed versions (5.0.8 or 4.2.15) or apply the provided workaround to mitigate the risk. Regularly monitoring and updating dependencies is essential to ensure the security of Django-based applications.
See every vulnerability recorded for django →
FAQ
The vulnerability can result in significant memory consumption, potentially leading to denial-of-service (DoS) attacks. It can cause degraded performance or even render the system unavailable.
You can check the version of Django installed in your project by running the command 'python -m django --version' in your terminal. If the version is 5.0 or 4.2, you should verify the specific patch level to determine if it is affected.
No, only Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15 are affected by this vulnerability. It is recommended to upgrade to the fixed versions.
Yes, a temporary workaround is to preprocess the input and convert numbers in scientific notation to a more manageable format before applying the floatformat filter. Refer to the provided code example for implementation details.
You can find more information about this vulnerability, including its technical details and the specific patches, in the official Django advisory database. The source link is provided in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for django.
