CVE-2026-15337

Aliases:UBUNTU-CVE-2026-15337DEBIAN-CVE-2026-15337
Advisory lineage Upstream: 0 Downstream: 6
Analyzed
Published: 04 Aug 2026, 15:48
Last modified:04 Aug 2026, 17:21

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
6.9 MEDIUM
v4.0 (cve.org)
EPSS Score
1.03% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Aug 2026, 15:48
Published
Vulnerability first disclosed
04 Aug 2026, 17:21
Last Modified
Vulnerability information updated

Description

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jaeyoung Jang for reporting this issue.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  • v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 1.03%• Percentile: 62%

Techniques & Countermeasures

  • CWE-789•Memory Allocation with Excessive Size Value

    The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Affected Systems

  • debian•python-django

    all | < 2:2.2.28-1~deb11u13 | < 3:3.2.25-0+deb12u4 | all | < 3:5.2.17-1

  • ubuntu•python-django

    all | all | all | all

  • djangoproject•django

    ≥ 5.2, < 5.2.17 | < 5.2.17 | ≥ 6.0, < 6.0.8

References (10)