CVE-2015-5963: Django SessionMiddleware Denial of Service
Summary
CVE-2015-5963: contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consum... Affects django across 3 version ranges.
>= 1.4, < 1.4.22
>= 1.7, < 1.7.10
>= 1.8, < 1.8.4
Fixed in 1.4.22, 1.7.10 or 1.8.4, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2015-5963 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It includes a session management feature that allows users to store and retrieve data across multiple requests. The SessionMiddleware component is responsible for handling session-related operations. However, versions of Django prior to 1.8.4, 1.7.10, and 1.4.22 are vulnerable to a denial of service attack.
Vulnerability Detail
The vulnerability, identified as CVE-2015-5963, exists in the contrib.sessions.middleware.SessionMiddleware component of Django. Attackers can exploit this vulnerability by sending a large number of requests to the contrib.auth.views.logout endpoint. This triggers the creation of empty session records, leading to excessive consumption of session store resources or the removal of legitimate session records. The impact of this attack can result in a denial of service, preventing legitimate users from accessing the application.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.4, < 1.4.221.4.22pip install --upgrade "django==1.4.22" -
>= 1.7, < 1.7.101.7.10pip install --upgrade "django==1.7.10" -
>= 1.8, < 1.8.41.8.4pip install --upgrade "django==1.8.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by modifying the application's code. One possible workaround is to implement rate limiting or request throttling mechanisms to limit the number of requests to the logout endpoint. This can help mitigate the impact of the denial of service attack by reducing the number of empty session records created.
Conclusion
The vulnerability in Django's SessionMiddleware component can be exploited to cause a denial of service. It is crucial to upgrade to the patched versions of Django to mitigate this vulnerability. If immediate upgrade is not possible, implementing rate limiting or request throttling mechanisms can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies the development of web applications by providing a set of tools and libraries.
The SessionMiddleware component in Django is responsible for managing user sessions, allowing data to be stored and retrieved across multiple requests.
The vulnerability can be exploited by sending a large number of requests to the logout endpoint, triggering the creation of empty session records and consuming session store resources.
The vulnerability can result in a denial of service, preventing legitimate users from accessing the application.
To fix this vulnerability, upgrade Django to version 1.8.4, 1.7.10, or 1.4.22, which include the necessary patches to mitigate the denial of service attack.
Related vulnerabilities
Recent vulnerabilities recorded for django.
