Denial-of-Service Vulnerability in Python-Django: CVE-2025-32873
Summary
UBUNTU-CVE-2025-32873: An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features, including an ORM, routing, and templating. The framework is known for its scalability and security features. However, it is susceptible to vulnerabilities that can impact its performance and reliability, such as the one identified in CVE-2025-32873.
Vulnerability Detail
CVE-2025-32873 is a denial-of-service vulnerability found in Django versions 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The issue arises from the django.utils.html.strip_tags() function, which can experience slow performance when processing inputs with large sequences of incomplete HTML tags. This vulnerability can lead to degraded application performance, potentially affecting user experience and application availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing user inputs that contain large sequences of incomplete HTML tags. Implement input validation to sanitize and limit the size of incoming data to mitigate the risk of triggering the vulnerability.
Conclusion
CVE-2025-32873 presents a significant risk to applications using vulnerable versions of Python-Django, potentially leading to denial-of-service conditions. It is crucial for developers and system administrators to apply the necessary updates and implement workarounds to safeguard their applications.
See every vulnerability recorded for python-django →
FAQ
CVE-2025-32873 is a denial-of-service vulnerability in Django that affects certain versions of the framework, leading to potential performance degradation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions include Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1.
If immediate updates are not possible, implement input validation to limit the size and format of incoming data as a temporary workaround.
The CVSS score for CVE-2025-32873 is 5.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
