Denial of Service Vulnerability in Python-Django: CVE-2025-26699
Summary
UBUNTU-CVE-2025-26699: An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, templating, and security features. However, certain versions of Django are vulnerable to a denial-of-service attack due to improper handling of long strings in the django.utils.text.wrap() method and wordwrap template filter.
Vulnerability Detail
The vulnerability identified as CVE-2025-26699 affects Django versions 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. It arises from the django.utils.text.wrap() method and the wordwrap template filter being susceptible to denial-of-service attacks when processing excessively long strings. This could lead to application downtime or unresponsiveness, impacting user experience and service availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not possible, consider implementing input validation to limit the length of strings processed by the wrap() method and wordwrap template filter. This can help mitigate the risk of denial-of-service attacks.
Conclusion
CVE-2025-26699 presents a significant risk to applications using vulnerable versions of Python-Django, potentially leading to denial-of-service attacks. It is crucial to update to the patched versions or implement workarounds to safeguard your applications.
See every vulnerability recorded for python-django →
FAQ
CVE-2025-26699 is a vulnerability in certain versions of Python-Django that allows for denial-of-service attacks due to improper handling of long strings.
The affected versions include Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score for CVE-2025-26699 is 5.0, indicating a medium severity level.
If you cannot update immediately, implement input validation to restrict the length of strings processed by the vulnerable methods to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
