PT-2026-67751 · Django · Django
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Django versions prior to 5.2.17
Django versions prior to 6.0.8
Description
A denial-of-service issue exists in the
check for language() function within django.utils.translation. The problem occurs when the function receives numerous distinct and very long language codes, which are stored as keys in an in-memory cache, leading to excessive process memory consumption. These codes are passed to the function via the set language() view in django.views.i18n, which is not routed by default. Memory consumption is limited by the DATA UPLOAD MAX MEMORY SIZE setting and a fixed maximum number of cache entries.Recommendations
Update to version 5.2.17 or later.
Update to version 6.0.8 or later.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Django