CVE-2023-43665: Django Denial-of-service in django.utils.text.Truncator
Summary
CVE-2023-43665: Django Denial-of-service in django.utils.text.Truncator. Affects django across 3 version ranges.
>= 3.2a1, < 3.2.22
>= 4.1a1, < 4.1.12
>= 4.2a1, < 4.2.6
Fixed in 3.2.22, 4.1.12 or 4.2.6, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2023-43665 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a range of features and tools for efficient and secure web development. One of its components, django.utils.text.Truncator, is responsible for truncating text in Django templates. This component is vulnerable to a denial-of-service (DoS) attack in Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6. The vulnerability arises when the chars() and words() methods of Truncator are used with html=True and provided with very long, potentially malformed HTML text. This issue can lead to a DoS attack, impacting the availability of the affected Django applications. It is important to note that this vulnerability is a result of an incomplete fix for CVE-2019-14232.
Vulnerability Detail
The vulnerability in django.utils.text.Truncator can be exploited by an attacker by providing excessively long and potentially malformed HTML text to the chars() and words() methods when used with html=True. This can cause a DoS attack, leading to the unavailability of the affected Django applications. The truncatechars_html and truncatewords_html template filters, which rely on the vulnerable methods, are also affected. The issue was assigned CVE-2023-43665 and has a CVSS score of 5.9. It is considered a moderate severity vulnerability.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.2a1, < 3.2.223.2.22pip install --upgrade "django==3.2.22" -
>= 4.1a1, < 4.1.124.1.12pip install --upgrade "django==4.1.12" -
>= 4.2a1, < 4.2.64.2.6pip install --upgrade "django==4.2.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is advised to avoid using the truncatechars_html and truncatewords_html template filters until the Django framework is updated to a fixed version. By not using these filters, the vulnerable methods will not be invoked, mitigating the risk of a DoS attack.
Conclusion
In conclusion, the Django framework is vulnerable to a denial-of-service attack due to a flaw in the django.utils.text.Truncator component. By providing excessively long and potentially malformed HTML text, an attacker can cause a DoS condition, rendering the affected Django applications unavailable. It is crucial to upgrade Django to the fixed versions mentioned and avoid using the vulnerable template filters until the upgrade is performed. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability can be exploited to launch a denial-of-service attack, causing the affected Django applications to become unavailable.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
Yes, upgrading Django to version 3.2.22, 4.1.12, or 4.2.6 will address this vulnerability.
Avoid using the truncatechars_html and truncatewords_html template filters until the Django framework is updated to a fixed version.
This vulnerability is considered moderate, with a CVSS score of 5.9.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
