CVE-2024-41991: Django CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Other sources
Description: urlize, urlizetrunc, and AdminURLFieldWidget were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Affected versions =================
Django main development branch Django 5.1 (currently at release candidate status) Django 5.0 Django 4.2
— Red Hat
Django is vulnerable to a denial of service, caused by a flaw in django.utils.html.urlize() and AdminURLFieldWidget method. By sending a vspecially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41991?
CVE-2024-41991 is classified as a moderate severity vulnerability due to its potential for denial-of-service attacks.
How do I fix CVE-2024-41991?
To mitigate CVE-2024-41991, upgrade Django to version 4.2.15 or 5.0.8 or later.
Which versions of Django are affected by CVE-2024-41991?
CVE-2024-41991 affects Django versions 5.0 prior to 5.0.8 and 4.2 prior to 4.2.15.
What components of Django are impacted by CVE-2024-41991?
CVE-2024-41991 impacts the urlize and urlizetrunc template filters and the AdminURLFieldWidget widget.
Can CVE-2024-41991 cause service interruptions?
Yes, CVE-2024-41991 can lead to service interruptions via denial-of-service attacks when vulnerable inputs are processed.