Denial-of-Service in Django via Language Variant Processing

Executive Summary

This vulnerability is a denial-of-service issue in Django versions 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. It occurs when the function django.utils.translation.get_supported_language_variant() processes many distinct, very long language codes. These codes are stored in an in-memory cache, consuming excessive process memory and potentially crashing the system.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check your Django version using 'python -c "import django; print(django.get_version())"'. If you are running Django 6.1 before 6.1.2, 6.0 before 6.0.9, or 5.2 before 5.2.18, or any unsupported series like 5.1.x, 5.0.x, or 4.2.x, your system may be affected.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause system slowdowns or crashes due to excessive memory consumption. Attackers could exploit it by sending requests with many long language codes, leading to resource exhaustion and denial of service for legitimate users.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of Django: 6.1.2, 6.0.9, or 5.2.18. If using an unsupported series, upgrade to a supported version or apply relevant patches if available.

Useful 0 Not Useful 0