CVE-2007-5712: Django Internationalization Denial of Service
Summary
CVE-2007-5712: The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cau... Affects django versions < 1.1. Fixed in 1.1. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2007-5712 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for developing web applications. It includes an internationalization (i18n) framework that allows developers to create multilingual websites. The i18n component enables the translation of web content into different languages based on user preferences. However, versions 0.91, 0.95, 0.95.1, and 0.96 of Django, as well as other products like PyLucid, are vulnerable to a denial of service (DoS) attack when the USE_I18N option and the i18n component are enabled. This vulnerability can be exploited by sending multiple HTTP requests with large Accept-Language headers.
Vulnerability Detail
The vulnerability in Django's i18n framework allows remote attackers to consume excessive memory resources, leading to a denial of service. By sending a large number of HTTP requests with large Accept-Language headers, an attacker can cause the server to exhaust its memory, resulting in degraded performance or even a complete system crash. This vulnerability can be particularly damaging in scenarios where the affected application is deployed in a production environment and handles a high volume of traffic.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1
This is the first release that contains the fix.
pip install --upgrade "django==1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the USE_I18N option in Django's configuration. This can be achieved by setting 'USE_I18N = False' in the settings.py file of the Django project. However, disabling internationalization may impact the functionality of multilingual features in the application. Therefore, it is recommended to apply the official fix by upgrading to a patched version of Django as soon as possible.
Conclusion
The vulnerability in Django's i18n framework can be exploited to cause a denial of service by consuming excessive memory resources. It is crucial to upgrade to a patched version of Django to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows remote attackers to cause a denial of service by consuming excessive memory resources. This can lead to degraded performance or even a complete system crash.
Versions 0.91, 0.95, 0.95.1, and 0.96 of Django are affected by this vulnerability.
Yes, other products that use Django's i18n framework, such as PyLucid, are also vulnerable to this issue.
Yes, administrators can temporarily disable the USE_I18N option in Django's configuration as a workaround. However, this may impact multilingual functionality.
To fix this vulnerability, upgrade to a fixed version of Django (1.1 or later) that includes the patch for this issue.
Related vulnerabilities
Recent vulnerabilities recorded for django.
