Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Django Truncator Method Can Be Exploited to Crash Server

CVE-2023-43665 · published 3 years ago
Summary

A maliciously crafted piece of HTML text can cause a Django server to crash. This affects Django versions 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6. To protect your server, update to the latest version of Django as soon as possible.

What to do
  • Update debian python-django to version 3:3.2.25-0+deb12u1.
  • Update debian python-django to version 3:4.2.6-1.
  • Update django software foundation django to version 3.2.22.
  • Update django software foundation django to version 4.1.12.
  • Update django software foundation django to version 4.2.6.
Affected software
Ecosystem VendorProductAffected versions
– djangoproject django >= 3.2, < 3.2.22
>= 4.1, < 4.1.12
>= 4.2, < 4.2.6
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
– fedoraproject fedora 39
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
Debian:12 debian python-django < 3:3.2.25-0+deb12u1
Fix: upgrade to 3:3.2.25-0+deb12u1
Debian:13 debian python-django < 3:4.2.6-1
Fix: upgrade to 3:4.2.6-1
Debian:14 debian python-django < 3:4.2.6-1
Fix: upgrade to 3:4.2.6-1
pip django software foundation django >= 3.2a1, < 3.2.22
>= 4.1a1, < 4.1.12
>= 4.2a1, < 4.2.6
Fix: upgrade to 3.2.22
Original advisory text
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial o...
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.7 High
Exploitation
1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published3 Nov 2023
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-h8gc-pgj2-vjm3 · GHSA
CVE-2023-43665 · NVD
CVE-2023-43665 · OSV
DEBIAN-CVE-2023-43665 · OSV
Track software like this
Free during beta