CVE-2024-27351

Name of the Vulnerable Software and Affected Versions Django versions 3.2 through 3.2.24 Django versions 4.2 through 4.2.10 Django versions 5.0 through 5.0.2

Description The issue is related to a potential regular expression denial-of-service in the django.utils.text.Truncator.words() method. This could allow a remote attacker to cause a denial-of-service. The truncatewords html template filter is also subject to this potential attack via a crafted string.

Recommendations For Django versions 3.2 through 3.2.24, update to version 3.2.25 or later. For Django versions 4.2 through 4.2.10, update to version 4.2.11 or later. For Django versions 5.0 through 5.0.2, update to version 5.0.3 or later. As a temporary workaround, consider disabling the django.utils.text.Truncator.words() method with html=True until a patch is available. Restrict access to the truncatewords html template filter to minimize the risk of exploitation.