CVE-2024-41989 — Uncontrolled Resource Consumption in Django

CWE-400 — Uncontrolled Resource Consumption10 documents8 sources
Severity
7.5HIGHNVD
EPSS
1.4%
top 19.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Djangoproject Django
Timeline
PublishedAug 7
Latest updateSep 22

Description

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDdjangoproject/django4.2 — 4.2.15+1
▶PyPIdjangoproject/django5.0 — 5.0.8+1

Patches

Patch: docs.djangoproject.com ↗

🔴Vulnerability Details

5
CVEList
CVE-2024-41989: An issue was discovered in Django 5↗2024-08-07
▶
OSV
CVE-2024-41989: An issue was discovered in Django 5↗2024-08-07
▶
GHSA
Django memory consumption vulnerability↗2024-08-07
▶
OSV
Django memory consumption vulnerability↗2024-08-07
▶
OSV
python-django vulnerabilities↗2024-08-06
▶

📋Vendor Advisories

3
Red Hat
python-django: Memory exhaustion in django.utils.numberformat.floatformat()↗2024-08-06
▶
Ubuntu
Django vulnerabilities↗2024-08-06
▶
Debian
CVE-2024-41989: python-django - An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The fl...↗2024
▶

💬Community

1
HackerOne
CVE-2024-41989: Denial-Of-Service vulnerability in the floatformat template filter when input string contains a big exponent in scientific notation↗2024-09-22
▶
CVE-2024-41989 — Uncontrolled Resource Consumption | cvebase