CVE-2024-41991: Django Denial-of-Service Vulnerability
Summary
CVE-2024-41991: Django vulnerable to denial-of-service attack. Affects django across 2 version ranges.
>= 4.2, < 4.2.15
>= 5.0, < 5.0.8
Fixed in 4.2.15 or 5.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2024-41991 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and versatility. It provides a robust set of tools and libraries for building web applications. However, versions 5.0 before 5.0.8 and 4.2 before 4.2.15 of Django are susceptible to a denial-of-service attack. This vulnerability affects the urlize and urlizetrunc template filters, as well as the AdminURLFieldWidget widget. Attackers can exploit this vulnerability by providing inputs with an excessive number of Unicode characters.
Vulnerability Detail
The Django vulnerability allows attackers to launch denial-of-service attacks against affected applications. By sending specially crafted inputs with a large number of Unicode characters, the urlize and urlizetrunc template filters, as well as the AdminURLFieldWidget widget, can be overwhelmed, leading to resource exhaustion and potential service disruption. This vulnerability poses a moderate risk to affected systems.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.154.2.15pip install --upgrade "django==4.2.15" -
>= 5.0, < 5.0.85.0.8pip install --upgrade "django==5.0.8"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and limit the number of Unicode characters allowed in the affected inputs. By enforcing reasonable limits, the risk of exploitation can be reduced. Here is an example of input validation in Python:
# Limit the number of Unicode characters to 1000
input_string = request.POST.get('input_string', '')
if len(input_string) > 1000:
# Handle the error or truncate the input
input_string = input_string[:1000]
Conclusion
The Django framework is vulnerable to a denial-of-service attack due to a flaw in the urlize and urlizetrunc template filters, as well as the AdminURLFieldWidget widget. Attackers can exploit this vulnerability by providing inputs with an excessive number of Unicode characters. It is crucial to update Django to the latest patched version to mitigate the risk of denial-of-service attacks.
See every vulnerability recorded for django →
FAQ
The vulnerability allows attackers to launch denial-of-service attacks, potentially causing service disruption and resource exhaustion.
Versions 5.0 before 5.0.8 and 4.2 before 4.2.15 of Django are affected by this vulnerability.
To mitigate the risk, it is recommended to update Django to version 5.0.8 or later (for Django 5.0) or version 4.2.15 or later (for Django 4.2).
Yes, developers can implement input validation and limit the number of Unicode characters allowed in the affected inputs as a temporary workaround.
Yes, the CVSS score for this vulnerability is 5.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
