CVE-2018-7536

django: Catastrophic backtracking in regular expressions via 'urlize' and 'urlizetrunc'

Published Mar 9, 2018 CVSS 3.0 · 5.3 Medium EPSS 4.6% KEV · Not listed
Description
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-1303-1 python-django security update
Debian DSA Debian DSA DSA-4161-1 python-django security update
EUVD EUVD EUVD-2018-0040 An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
Github GHSA Github GHSA GHSA-r28v-mw67-m5p9 Django denial-of-service possibility in urlize and urlizetrunc template filters
Ubuntu USN Ubuntu USN USN-3591-1 Django vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 5, 2024, 6:31 AM
Reserved
Feb 26, 2018, 12:00 AM
Status
Modified
Published
Mar 9, 2018, 8:29 PM
Modified
Jun 17, 2026, 2:03 AM
Severity
Moderate
Public date
Mar 6, 2018, 12:00 AM