An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.
References
| Link | Resource |
|---|---|
| https://docs.djangoproject.com/en/dev/releases/security/ | Patch Vendor Advisory |
| https://groups.google.com/g/django-announce | Release Notes |
| https://www.openwall.com/lists/oss-security/2024/12/04/3 | Mailing List Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
24 Jun 2025, 14:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://docs.djangoproject.com/en/dev/releases/security/ - Patch, Vendor Advisory | |
| References | () https://groups.google.com/g/django-announce - Release Notes | |
| References | () https://www.openwall.com/lists/oss-security/2024/12/04/3 - Mailing List, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html - Mailing List, Third Party Advisory | |
| First Time |
Djangoproject
Djangoproject django |
|
| CPE | cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* |
31 Dec 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Dec 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-12-06 12:15
Updated : 2025-06-24 14:55
NVD link : CVE-2024-53907
Mitre link : CVE-2024-53907
CVE.ORG link : CVE-2024-53907
JSON object : View
Products Affected
djangoproject
- django
CWE
CWE-770
Allocation of Resources Without Limits or Throttling