CVE-2019-6975: Django Uncontrolled Memory Consumption
Summary
CVE-2019-6975: Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function. Affects django across 3 version ranges.
>= 1.11, < 1.11.19
>= 2.0, < 2.0.12
>= 2.1, < 2.1.7
Fixed in 1.11.19, 2.0.12 or 2.1.7, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2019-6975 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a robust set of tools and features for building secure and scalable websites. However, versions 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 are vulnerable to Uncontrolled Memory Consumption. This vulnerability arises from a flaw in the django.utils.numberformat.format() function, which can be exploited by a malicious attacker.
Vulnerability Detail
The Uncontrolled Memory Consumption vulnerability in Django allows an attacker to consume excessive memory resources by supplying a specially crafted value to the django.utils.numberformat.format() function. This can lead to denial of service (DoS) attacks, as the targeted application may become unresponsive or crash due to resource exhaustion. The vulnerability affects Django versions 1.11.x, 2.0.x, and 2.1.x.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.11, < 1.11.191.11.19pip install --upgrade "django==1.11.19" -
>= 2.0, < 2.0.122.0.12pip install --upgrade "django==2.0.12" -
>= 2.1, < 2.1.72.1.7pip install --upgrade "django==2.1.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization to prevent malicious inputs from reaching the vulnerable function. By validating and sanitizing user-supplied values before passing them to the django.utils.numberformat.format() function, the risk of exploitation can be mitigated. Here is an example of input validation and sanitization in Python:
value = request.GET.get('value')
# Validate and sanitize the input
if value is not None and isinstance(value, int):
# Perform the necessary operations
formatted_value = django.utils.numberformat.format(value)
else:
# Handle invalid input
formatted_value = 'Invalid input'
Conclusion
The Uncontrolled Memory Consumption vulnerability in Django can have severe consequences, leading to denial of service (DoS) attacks. It is crucial to promptly upgrade to the patched versions or apply the recommended fixes to ensure the security and stability of your Django applications. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows an attacker to consume excessive memory resources, leading to denial of service (DoS) attacks. This can result in the targeted application becoming unresponsive or crashing.
The vulnerability affects Django versions 1.11.x, 2.0.x, and 2.1.x. Specifically, versions before 1.11.19, 2.0.11, and 2.1.6 are vulnerable.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the recommended patches or upgrades to mitigate the risk.
Yes, a temporary workaround involves implementing input validation and sanitization to prevent malicious inputs from reaching the vulnerable function. This can help mitigate the risk of exploitation.
For more information about this vulnerability, you can refer to the official Django security advisory at: https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2019-18.yaml
Related vulnerabilities
Recent vulnerabilities recorded for django.
