CVE-2015-0222: Django ModelMultipleChoiceField Denial of Service
Summary
CVE-2015-0222: ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers... Affects django across 3 version ranges.
< 1.4.18
>= 1.5, < 1.6.10
>= 1.7, < 1.7.3
Fixed in 1.4.18, 1.6.10 or 1.7.3, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2015-0222 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides various features and components to handle common web development tasks. One of these components is the ModelMultipleChoiceField, which allows users to select multiple choices from a predefined set of options. However, versions of Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3 are vulnerable to a denial of service attack when the show_hidden_initial parameter is set to True. This vulnerability can be exploited by submitting duplicate values, leading to a large number of SQL queries and causing a denial of service.
Vulnerability Detail
The vulnerability (CVE-2015-0222) in Django's ModelMultipleChoiceField arises from a lack of input validation. When the show_hidden_initial parameter is enabled, an attacker can submit duplicate values, triggering a significant number of SQL queries. This can overwhelm the database and cause a denial of service, rendering the affected application unavailable to legitimate users. The impact of this vulnerability can range from temporary unavailability to a complete system crash, depending on the resources available to the database.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.4.181.4.18pip install --upgrade "django==1.4.18" -
>= 1.5, < 1.6.101.6.10pip install --upgrade "django==1.6.10" -
>= 1.7, < 1.7.31.7.3pip install --upgrade "django==1.7.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by setting the show_hidden_initial parameter to False. This can be done in the relevant code section where the ModelMultipleChoiceField is used. By disabling the show_hidden_initial feature, the vulnerability can be mitigated until a proper upgrade can be performed. Here is an example of how to apply the workaround in Django code:
# Set show_hidden_initial to False
field = ModelMultipleChoiceField(queryset=choices, show_hidden_initial=False)
Conclusion
The vulnerability (CVE-2015-0222) in Django's ModelMultipleChoiceField can lead to a denial of service attack by submitting duplicate values. Upgrading to Django versions 1.6.10 or 1.7.3 (or later) is recommended to fix this vulnerability. If immediate upgrade is not possible, setting the show_hidden_initial parameter to False can serve as a temporary workaround. It is crucial to address this vulnerability to protect the availability of Django applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability can lead to a denial of service, causing the affected application to become unavailable to legitimate users. The severity of the impact depends on the resources available to the database.
To fix this vulnerability, upgrade to Django versions 1.6.10 or 1.7.3 (or later). These versions contain the necessary patches to mitigate the issue.
Yes, a temporary workaround is to set the show_hidden_initial parameter to False in the relevant code section. This can help mitigate the vulnerability until a proper upgrade can be performed.
Yes, this vulnerability can be exploited remotely by submitting duplicate values to the ModelMultipleChoiceField.
There are no known instances of this vulnerability being actively exploited in the wild. However, it is still important to apply the necessary fixes to ensure the security of Django applications.
Related vulnerabilities
Recent vulnerabilities recorded for django.
