CVE-2024-53907

Published: Dec 6, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

Affected (3)

Products: Djangoproject: Django

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	From 4.2 to 4.2.17
Djangoproject Django	From 5.0 to 5.0.10
Djangoproject Django	From 5.1 to 5.1.4

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://docs.djangoproject.com/en/dev/releases/security/

Source: cve@mitre.org

PatchVendor Advisory

https://groups.google.com/g/django-announce

Source: cve@mitre.org

Release Notes

https://www.openwall.com/lists/oss-security/2024/12/04/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.