CVE-2025-32873

{"id": "CVE-2025-32873", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-05-08T04:17:18.157", "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "source": "cve@mitre.org"}, {"url": "https://groups.google.com/g/django-announce", "source": "cve@mitre.org"}, {"url": "https://www.djangoproject.com/weblog/2025/may/07/security-releases/", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/05/07/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags()."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Django 4.2 (anterior a 4.2.21), 5.1 (anterior a 5.1.9) y 5.2 (anterior a 5.2.1). La funci\u00f3n django.utils.html.strip_tags() es vulnerable a una posible denegaci\u00f3n de servicio (rendimiento lento) al procesar entradas que contienen grandes secuencias de etiquetas HTML incompletas. El filtro de plantilla striptags tambi\u00e9n es vulnerable, ya que est\u00e1 basado en strip_tags()."}], "lastModified": "2025-05-08T14:39:09.683", "sourceIdentifier": "cve@mitre.org"}