CVE-2016-2513: Django Password Hasher Timing Attack
Summary
CVE-2016-2513: The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests. Affects django across 3 version ranges.
< 1.8.10
>= 1.9, < 1.9.3
< 67b46ba7016da2d259c1ecc7d666d11f5e1cfaab
Fixed in 1.8.10 or 1.9.3, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2016-2513 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that enables rapid development and clean design. It provides a set of tools and libraries for building web applications. The password hasher in Django's contrib/auth/hashers.py module is responsible for securely hashing user passwords. This vulnerability affects Django versions before 1.8.10 and 1.9.x before 1.9.3. It allows remote attackers to enumerate users through a timing attack involving login requests.
Vulnerability Detail
The vulnerability arises from a timing attack that can be exploited by remote attackers. By carefully measuring the time it takes for a login request to be processed, an attacker can determine whether a user exists in the system. This information leakage can be used to enumerate valid usernames, which can then be targeted for further attacks. The vulnerability is present in the password hasher implementation in Django's contrib/auth/hashers.py module.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.8.101.8.10pip install --upgrade "django==1.8.10" -
>= 1.9, < 1.9.31.9.3pip install --upgrade "django==1.9.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is advisable to implement additional security measures such as rate limiting or account lockouts to mitigate the impact of timing attacks.
Conclusion
The Django password hasher timing attack vulnerability allows remote attackers to enumerate users through a timing attack involving login requests. To mitigate this vulnerability, it is crucial to upgrade Django to version 1.8.10 or 1.9.3, depending on the installed version. Implementing additional security measures like rate limiting or account lockouts can also help reduce the impact of timing attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
A timing attack is a type of side-channel attack where an attacker measures the time taken by a system to perform certain operations. By analyzing these timing differences, an attacker can gain information about the system's internal state or sensitive data.
By sending multiple login requests and measuring the response times, an attacker can determine whether a user exists in the system. This information can be used to enumerate valid usernames and potentially launch further attacks.
No, only Django versions before 1.8.10 and 1.9.x before 1.9.3 are affected. It is recommended to upgrade to the fixed versions to mitigate the vulnerability.
There is no known public exploit for this vulnerability at the moment. However, it is important to apply the recommended fixes to prevent potential attacks.
While upgrading to the fixed versions is the recommended approach, additional security measures such as rate limiting or account lockouts can help mitigate the impact of timing attacks.
Related vulnerabilities
Recent vulnerabilities recorded for django.
