CVE-2024-56374: Django Denial-of-Service Vulnerability in IPv6 Validation
Summary
CVE-2024-56374: Django has a potential denial-of-service vulnerability in IPv6 validation. Affects django across 3 version ranges.
>= 4.2, < 4.2.18
>= 5.0, < 5.0.11
>= 5.1, < 5.1.5
Fixed in 4.2.18, 5.0.11 or 5.1.5, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2024-56374 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and offers features such as an ORM, authentication, and an admin interface. However, certain versions of Django are vulnerable to a denial-of-service attack due to improper validation of IPv6 addresses, which can lead to application crashes or unresponsiveness.
Vulnerability Detail
The vulnerability arises from a lack of upper-bound limit enforcement in strings passed during IPv6 validation. Specifically, the undocumented private functions clean_ipv6_address and is_valid_ipv6_address, as well as the django.forms.GenericIPAddressField form field, are susceptible. This could allow an attacker to craft malicious input that overwhelms the application, leading to a denial-of-service condition. The affected versions include Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.184.2.18pip install --upgrade "django==4.2.18" -
>= 5.0, < 5.0.115.0.11pip install --upgrade "django==5.0.11" -
>= 5.1, < 5.1.55.1.5pip install --upgrade "django==5.1.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation on your own to limit the length of IPv6 address strings before they are processed by Django. This can help mitigate the risk until you are able to upgrade to a secure version.
Conclusion
In summary, CVE-2024-56374 is a denial-of-service vulnerability in certain versions of Django due to improper IPv6 validation. It is crucial to update to the latest patched versions to protect your application from potential attacks. Utilize Vulert to monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for django →
FAQ
CVE-2024-56374 is a vulnerability in Django that allows for potential denial-of-service attacks due to improper validation of IPv6 addresses.
Django versions 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.8, indicating a moderate severity level.
If you cannot upgrade immediately, implement input validation to limit the length of IPv6 address strings as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
