Elias Myllymäki

An issue was discovered in Django, where the `django.utils.html.strip tags()` function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter `striptags` is also vulnerable, because it is built on top of `strip tags()`. This issue can be exploited by attackers to crash servers via malformed HTML.

The issue is related to the `floatformat()` function in Django, which can lead to uncontrolled resource consumption. This can be exploited by a remote attacker to cause a denial of service. The `floatformat` template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

The issue is related to a potential denial of service attack via certain inputs with a very large number of brackets in the `urlize` and `urlizetrunc` functions. This can cause uncontrolled resource consumption due to poor time complexity of `strip punctuation`. The vulnerability may allow a remote attacker to cause a denial of service.