CVE-2025-32873: Django Denial-of-Service Vulnerability in strip_tags() Function
Summary
CVE-2025-32873: Django has a denial-of-service possibility in strip_tags(). Affects django across 3 version ranges.
>= 4.2, < 4.2.21
>= 5.1, < 5.1.9
>= 5.2, < 5.2.1
Fixed in 4.2.21, 5.1.9 or 5.2.1, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2025-32873 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and templating. However, certain versions of Django are vulnerable to a denial-of-service attack due to inefficiencies in the strip_tags() function, which can lead to slow performance when processing specific inputs.
Vulnerability Detail
An issue was discovered in Django versions 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The vulnerability lies in the django.utils.html.strip_tags() function, which is susceptible to denial-of-service attacks when handling inputs with large sequences of incomplete HTML tags. This can result in significant slowdowns, affecting the application's responsiveness and user experience.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.214.2.21pip install --upgrade "django==4.2.21" -
>= 5.1, < 5.1.95.1.9pip install --upgrade "django==5.1.9" -
>= 5.2, < 5.2.15.2.1pip install --upgrade "django==5.2.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation to filter out potentially problematic HTML tags before they are processed by the strip_tags() function. This can help mitigate the impact of the vulnerability until an upgrade is performed.
Conclusion
In summary, the CVE-2025-32873 vulnerability in Django's strip_tags() function poses a risk of denial-of-service attacks due to inefficient handling of certain inputs. It is crucial to update to the latest patched versions to ensure the security and performance of your applications.
See every vulnerability recorded for django →
FAQ
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
Django versions 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to denial-of-service conditions, causing slow performance and potentially making the application unresponsive.
Yes, implementing input validation to filter out problematic HTML tags can serve as a temporary workaround until you can update to a secure version.
Related vulnerabilities
Recent vulnerabilities recorded for django.
