PT-2026-67751

CVE-2026-15337

Published

2026-08-04

Updated

2026-10-24

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Django versions prior to 5.2.17 Django versions prior to 6.0.8

Description A denial-of-service issue exists in the check for language() function within django.utils.translation. The problem occurs when the function receives numerous distinct and very long language codes, which are stored as keys in an in-memory cache, leading to excessive process memory consumption. These codes are passed to the function via the set language() view in django.views.i18n, which is not routed by default. Memory consumption is limited by the DATA UPLOAD MAX MEMORY SIZE setting and a fixed maximum number of cache entries.

Recommendations Update to version 5.2.17 or later. Update to version 6.0.8 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jaeyoung Jang

Natalia Bidart

Vendors

Affected products

Weakness enumeration

CWE-789: Memory Allocation with Excessive Size Value