CVE-2024-53907

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53907
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://docs.djangoproject.com/en/dev/releases/security/ Patch Vendor Advisory
https://groups.google.com/g/django-announce Release Notes
https://www.openwall.com/lists/oss-security/2024/12/04/3 Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
History

24 Jun 2025, 14:55

Type Values Removed Values Added
CPE cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
References () https://docs.djangoproject.com/en/dev/releases/security/ - () https://docs.djangoproject.com/en/dev/releases/security/ - Patch, Vendor Advisory
References () https://groups.google.com/g/django-announce - () https://groups.google.com/g/django-announce - Release Notes
References () https://www.openwall.com/lists/oss-security/2024/12/04/3 - () https://www.openwall.com/lists/oss-security/2024/12/04/3 - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html - () https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html - Mailing List, Third Party Advisory
First Time Djangoproject
Djangoproject django

31 Dec 2024, 18:15

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en Django 5.1 anterior a 5.1.4, 5.0 anterior a 5.0.10 y 4.2 anterior a 4.2.17. El método strip_tags() y el filtro de plantilla striptags están sujetos a un posible ataque de denegación de servicio a través de ciertas entradas que contienen secuencias grandes de entidades HTML incompletas anidadas.
References
  • () https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html -

06 Dec 2024, 17:15

Type Values Removed Values Added
CWE CWE-770
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

06 Dec 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-06 12:15

Updated : 2025-06-24 14:55

NVD link : CVE-2024-53907

Mitre link : CVE-2024-53907

CVE.ORG link : CVE-2024-53907

JSON object : View

Products Affected

djangoproject

  • django
CWE
CWE-770

Allocation of Resources Without Limits or Throttling