CVE-2024-41991: djangoproject django
Vulnerability summary
CVE-2024-41991 is a high (CVSS 7.5) vulnerability in djangoproject django. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 61.4% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 16 · Related 10Timeline
- 07-08-2024PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.95%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.95% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
- CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- py3-django< 4.2.16-r0
Debian1 product
- python-django< 3:3.2.25-0+deb12u1 | < 3:4.2.15-1
Djangoproject1 product
- django≥ 4.2, < 4.2.15 | ≥ 5.0, < 5.0.8
PyPI1 product
- django≥ 5.0, < 5.0.8 | ≥ 4.2, < 4.2.15
Ubuntu1 product
- python-djangoAll versions (No fix recorded) | < 1:1.11.11-1ubuntu1.21+esm6 | < 2:2.2.12-1ubuntu0.24 | < 2:3.2.12-2ubuntu1.13 | < 3:4.2.11-1ubuntu1.2
5 vendors · 5 products
References
18 links
- github.com/django/djangoPACKAGE
