medium5.0
CVE-2025-26699
Django vulnerable to Allocation of Resources Without Limits or Throttling
Impact
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | Django | >= 4.2, < 4.2.20 | 4.2.20 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Djangoproject | Django | from 4.2 before 4.2.20 from 5.0 before 5.0.13 from 5.1 before 5.1.7 |
| Debian | Debian Linux | Version 11.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/mar/06/security-releases/
- http://www.openwall.com/lists/oss-security/2025/03/06/12
- https://lists.debian.org/debian-lts-announce/2025/03/msg00012.html
- https://github.com/advisories/GHSA-p3fp-8748-vqfq
- https://nvd.nist.gov/vuln/detail/CVE-2025-26699
- https://docs.djangoproject.com/en/dev/releases/security
- https://www.djangoproject.com/weblog/2025/mar/06/security-releases
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-13.yaml