CVE-2025-32873

Published: May 8, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

Affected (3)

Products: Djangoproject: Django

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	From 4.2.0 to 4.2.21
Djangoproject Django	From 5.1 to 5.1.9
Djangoproject Django	Version 5.2

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://docs.djangoproject.com/en/dev/releases/security/

Source: cve@mitre.org

Release Notes

https://groups.google.com/g/django-announce

Source: cve@mitre.org

Mailing List

https://www.djangoproject.com/weblog/2025/may/07/security-releases/

Source: cve@mitre.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2025/05/07/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.