CVE-2025-32873: Django Denial-of-Service Vulnerability in strip_tags Function
Summary
CVE-2025-32873: An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. Affects django across 3 version ranges.
>= 4.2, < 4.2.21
>= 5.1, < 5.1.9
>= 5.2, < 5.2.1
Fixed in 4.2.21, 5.1.9 or 5.2.1, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2025-32873 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and templating. The framework is widely used for its scalability and security features. However, certain versions of Django are vulnerable to performance issues when processing specific inputs, particularly those containing large sequences of incomplete HTML tags.
Vulnerability Detail
An issue was discovered in Django versions 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The vulnerability lies in the django.utils.html.strip_tags() function, which can lead to a denial-of-service condition due to slow performance when handling inputs with large sequences of incomplete HTML tags. This can severely impact the responsiveness of applications using affected versions of Django, especially when processing user-generated content.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.214.2.21pip install --upgrade "django==4.2.21" -
>= 5.1, < 5.1.95.1.9pip install --upgrade "django==5.1.9" -
>= 5.2, < 5.2.15.2.1pip install --upgrade "django==5.2.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs to avoid sending large sequences of incomplete HTML tags to the strip_tags function. This can be done by implementing input validation or using a different method for processing HTML content.
Conclusion
The CVE-2025-32873 vulnerability in Django poses a significant risk of denial-of-service due to slow performance when processing certain inputs. It is crucial for developers using affected versions to update to the latest patched versions to mitigate this risk.
See every vulnerability recorded for django →
FAQ
The vulnerability can lead to denial-of-service conditions, causing slow performance and unresponsiveness in applications that process large sequences of incomplete HTML tags.
Django versions 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, implement input validation to prevent the submission of large sequences of incomplete HTML tags as a temporary measure.
More information can be found in the Django security advisories and on the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for django.
