CVE-2023-43665: Denial of Service Vulnerability in Django
Summary
CVE-2023-43665: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via c... Affects django across 3 version ranges.
>= 3.2, < 3.2.22
>= 4.1, < 4.1.12
>= 4.2, < 4.2.6
Fixed in 3.2.22, 4.1.12 or 4.2.6, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2023-43665 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and functionalities for building web applications. It is widely used due to its simplicity, scalability, and security features. However, Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6 are vulnerable to a Denial of Service (DoS) attack. This vulnerability affects the django.utils.text.Truncator chars() and words() methods when used with html=True. These methods are responsible for implementing the truncatechars_html and truncatewords_html template filters, which are also vulnerable. The issue exists due to an incomplete fix for CVE-2019-14232.
Vulnerability Detail
The vulnerability in Django allows an attacker to launch a DoS attack by exploiting certain inputs with very long, potentially malformed HTML text. By utilizing the chars() and words() methods with html=True, an attacker can overwhelm the system and cause it to become unresponsive. This can lead to service disruption and impact the availability of the affected Django application. It is important to note that this vulnerability is a result of an incomplete fix for a previous vulnerability.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.2, < 3.2.223.2.22pip install --upgrade "django==3.2.22" -
>= 4.1, < 4.1.124.1.12pip install --upgrade "django==4.1.12" -
>= 4.2, < 4.2.64.2.6pip install --upgrade "django==4.2.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the official fix by upgrading Django to the recommended versions.
Conclusion
The Denial of Service vulnerability in Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6 can be exploited by an attacker to cause service disruption. It is crucial for Django users to upgrade to the recommended versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability allows an attacker to launch a DoS attack, potentially causing service disruption and impacting the availability of the affected Django application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
No, there is no known workaround for this vulnerability. It is necessary to upgrade Django to the recommended versions.
Yes, Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6 are affected by this vulnerability.
You can find more information about this vulnerability in the official Django advisory: https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2023-226.yaml
Related vulnerabilities
Recent vulnerabilities recorded for django.
