Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Django Password Validation Overload Can Cause Slow Performance

CVE-2021-45115 · published 4 years ago
Summary

Django versions 2.2 to 4.0 have a bug that can cause slow performance when registering new users with very long passwords. This can be exploited to overload the system and make it harder for legitimate users to register. To fix this, update to Django 2.2.26 or later, 3.2.11 or later, or 4.0.1 or later.

What to do
  • Update django to version 2.2.26.
  • Update django to version 3.2.11.
  • Update django to version 4.0.1.
Affected software
Ecosystem VendorProductAffected versions
pip – django >= 2.2a1, < 2.2.26
>= 3.2a1, < 3.2.11
>= 4.0a1, < 4.0.1
Fix: upgrade to 2.2.26
– djangoproject django >= 2.2, < 2.2.26
>= 3.2, < 3.2.11
>= 4.0, < 4.0.1
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
– fedoraproject fedora 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that ...
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
References
Severity
8.7 High
CVSS 3.1: 7.5 (GHSA)
CVSS 4.0: 8.7 (GHSA)
Exploitation
EPSS 2%
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published5 Jan 2022
Updated18 Aug 2026
First seen6 Mar 2026
Sources
GHSA-53qw-q765-4fww · GHSA
CVE-2021-45115 · NVD
Monitor software like this
Free during beta