CVE-2026-33033

Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2026-33034

Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2025-64459

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.

CVSS 3.1 · 9.1 Critical EPSS 19.3% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2025-13473

Username enumeration through timing difference in mod_wsgi authentication handler

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2025-14550

Potential denial-of-service vulnerability via repeated headers when using ASGI

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2025-13372

Potential SQL injection in FilteredRelation column aliases on PostgreSQL

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2025-64460

Potential denial-of-service vulnerability in XML serializer text extraction

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2025-64458

Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Djangoproject Microsoft

Products

Django Windows

CVE-2025-59682

django: Potential partial directory-traversal via archive.extract()

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2025-59681

django: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB1

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2025-57833

django: Django SQL injection in FilteredRelation column aliases

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

CVSS 3.1 · 7.1 High EPSS 28.3% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2024-27351

python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Openstack and 3 more

CVE-2024-24680

Django: denial-of-service in ``intcomma`` template filter

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Openstack and 3 more

CVE-2023-43665

python-django: Denial-of-service possibility in django.utils.text.Truncator

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Djangoproject Fedoraproject Redhat

Products

Django Fedora Ansible Automation Platform and 3 more

CVE-2023-41164

python-django: Potential denial of service vulnerability in ``django.utils.encoding.uri_to_iri()``

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Djangoproject Fedoraproject Redhat

Products

Django Fedora Ansible Automation Platform and 3 more

CVE-2023-36053

python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed

Vendors

Debian Djangoproject Fedoraproject and 1 more

Products

Debian Linux Django Fedora and 5 more

CVE-2024-42005

python-django: Potential SQL injection in QuerySet.values() and values_list()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Discovery and 3 more

CVE-2024-41991

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Discovery and 3 more

CVE-2024-41990

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Rhui

CVE-2024-41989

python-django: Memory exhaustion in django.utils.numberformat.floatformat()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Discovery and 1 more