CVE-2024-41990: Django CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.
Other sources
Description: urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.
Affected versions =================
Django main development branch Django 5.1 (currently at release candidate status) Django 5.0 Django 4.2
— Red Hat
Django is vulnerable to a denial of service, caused by a flaw in django.utils.html.urlize() method. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41990?
CVE-2024-41990 has a severity level that indicates it is susceptible to denial-of-service attacks due to processing large inputs.
How do I fix CVE-2024-41990?
To fix CVE-2024-41990, upgrade Django to version 5.0.8 or 4.2.15 or later.
Which versions of Django are affected by CVE-2024-41990?
Django versions prior to 5.0.8 and 4.2.15 are affected by CVE-2024-41990.
What are the consequences of not addressing CVE-2024-41990?
Failing to address CVE-2024-41990 could lead to denial-of-service vulnerabilities which may disrupt application availability.
Is CVE-2024-41990 related to specific template filters in Django?
Yes, CVE-2024-41990 specifically affects the urlize() and urlizetrunc() template filters in Django.