CVE-2026-15337
Received Received - Intake

Denial-of-Service in Django via Language Code Cache

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Django Software Foundation

Description
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jaeyoung Jang for reporting this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-15337
EUVD
EUVD-2026-52748

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
django django to 5.2.17 (exc)
django django to 6.0.8 (exc)
django django 5.1
django django 5.0
django django 4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-15337 is a denial-of-service (DoS) vulnerability in Django's language handling. It occurs when very long language codes (over 500 characters) are processed by the `check_for_language()` function. These codes are stored as cache keys in memory, potentially consuming excessive process memory and causing crashes. The vulnerability is triggered via the `set_language()` view, which is not enabled by default.

Detection Guidance

To detect this vulnerability, monitor for unusually high memory usage in Django processes, particularly when handling language code requests. Check for POST requests to the set_language view with very long language codes (over 500 characters). Use tools like ps, top, or htop to observe memory consumption spikes in Django workers.

Impact Analysis

An attacker could exploit this by sending many distinct, very long language codes through POST data. This may lead to memory exhaustion in Django processes, causing service slowdowns or crashes. The impact is limited by Django's request size constraints and cache configuration, but the risk remains if the `set_language()` view is enabled.

Mitigation Strategies
  • Upgrade Django to version 5.2.17 or 6.0.8 or later to apply the fix.
  • If upgrading is not immediately possible, ensure the set_language view is not enabled in your Django project's URL configuration to prevent exploitation.
  • Monitor and limit request sizes to prevent excessively long language codes from being processed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart