CVE-2025-32873

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.20 Django versions 5.1 through 5.1.8 Django versions 5.2 through 5.2.0

Description An issue was discovered in Django, where the django.utils.html.strip tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip tags(). This issue can be exploited by attackers to crash servers via malformed HTML.

Recommendations For Django versions 4.2 through 4.2.20, update to version 4.2.21 or later. For Django versions 5.1 through 5.1.8, update to version 5.1.9 or later. For Django versions 5.2 through 5.2.0, update to version 5.2.1 or later. As a temporary workaround, consider disabling the strip tags() function or restricting the use of the striptags template filter until a patch is available.