CVE-2024-38875

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.13 Django versions 5.0 through 5.0.6

Description The issue is related to a potential denial of service attack via certain inputs with a very large number of brackets in the urlize and urlizetrunc functions. This can cause uncontrolled resource consumption due to poor time complexity of strip punctuation. The vulnerability may allow a remote attacker to cause a denial of service.

Recommendations For Django versions 4.2 through 4.2.13, update to version 4.2.14 or later. For Django versions 5.0 through 5.0.6, update to version 5.0.7 or later. As a temporary workaround, consider restricting the use of the urlize and urlizetrunc functions until a patch is available. Avoid using these functions with untrusted input to minimize the risk of exploitation.