CVE-2019-14233: Uncontrolled Resource Consumption in Django
Summary
CVE-2019-14233: Django Denial-of-service in strip_tags(). Affects django across 3 version ranges.
>= 1.11a1, < 1.11.23
>= 2.1a1, < 2.1.11
>= 2.2a1, < 2.2.4
Fixed in 1.11.23, 2.1.11 or 2.2.4, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2019-14233 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a robust set of tools and features for building secure and scalable websites. However, Django versions 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4 are vulnerable to an uncontrolled resource consumption issue. This vulnerability arises due to the behavior of the underlying HTMLParser. Specifically, the django.utils.html.strip_tags function becomes extremely slow when evaluating certain inputs containing large sequences of nested incomplete HTML entities.
Vulnerability Detail
The uncontrolled resource consumption vulnerability in Django can have significant consequences. Attackers can exploit this vulnerability to cause denial of service (DoS) attacks by sending specially crafted inputs to the affected Django application. These inputs can cause the application to consume excessive resources, leading to performance degradation or even complete unresponsiveness. The vulnerability is rated as HIGH severity with a CVSS score of 2.8.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.11a1, < 1.11.231.11.23pip install --upgrade "django==1.11.23" -
>= 2.1a1, < 2.1.112.1.11pip install --upgrade "django==2.1.11" -
>= 2.2a1, < 2.2.42.2.4pip install --upgrade "django==2.2.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading Django to the fixed versions.
Conclusion
The uncontrolled resource consumption vulnerability in Django can have severe consequences, including denial of service attacks. It is highly recommended to upgrade Django to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows attackers to launch denial of service attacks, potentially rendering the affected Django application unresponsive.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, only Django versions 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4 are vulnerable to this issue.
Yes, upgrading Django to version 1.11.23, 2.1.11, or 2.2.4 will fix this vulnerability.
No, there is no known workaround. It is crucial to apply the recommended fix by upgrading Django to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for django.
