CVE-2024-38875: Django CVE-2024-38875, CVE-2024-39329, CVE-2024-39330, and CVE-2024-39614
An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.
Other sources
Django is vulnerable to a denial of service, caused by improper input validation by the urlize() and urlizetrunc() functions. By sending a specially crafted request using large number of brackets, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
django.utils.html.urlize() was subject to a potential denial-of-service attack via certain inputs with a very large number of brackets.
Affected versions =================
Django main development branch Django 5.1 Django 5.0 Django 4.2
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38875?
CVE-2024-38875 has a severity that indicates a potential denial of service risk in affected versions of Django.
How do I fix CVE-2024-38875?
To fix CVE-2024-38875, upgrade to Django version 4.2.14 or 5.0.7 or later.
Which versions of Django are affected by CVE-2024-38875?
CVE-2024-38875 affects Django versions prior to 4.2.14 and 5.0 before 5.0.7.
What types of attacks are enabled by CVE-2024-38875?
CVE-2024-38875 may enable denial of service attacks through improper handling of inputs with numerous brackets.
Is there a specific recommendation for users of Django related to CVE-2024-38875?
Users of Django are advised to update their installations to the patched versions to mitigate the risks posed by CVE-2024-38875.