CVE-2024-41989

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.14 Django versions 5.0 through 5.0.7

Description The issue is related to the floatformat() function in Django, which can lead to uncontrolled resource consumption. This can be exploited by a remote attacker to cause a denial of service. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

Recommendations For Django versions 4.2 through 4.2.14, update to version 4.2.15 or later. For Django versions 5.0 through 5.0.7, update to version 5.0.8 or later. As a temporary workaround, consider restricting the use of the floatformat template filter to minimize the risk of exploitation. Avoid using the floatformat filter with input strings that contain large exponents in scientific notation until the issue is resolved.