CVE-2026-77050
published 2026-10-06CVE-2026-77050: An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_language_variant()` is…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.38%
30.9th percentile
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is subject to
a potential denial-of-service attack when processing many distinct, very long
language codes, which are retained as keys in an in-memory cache and
consume process memory.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Gleb Lizunov for reporting this issue.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | controller-rhel8 | — | — |
| ansible-automation-platform-24 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-24 | hub-rhel8 | — | — |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ansible-dev-tools-rhel8 | — | — |
| ansible-automation-platform-25 | controller-rhel8 | — | — |
| ansible-automation-platform-25 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-25 | gateway-rhel8 | — | — |
| ansible-automation-platform-25 | hub-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | aap-cloud-billing-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | metrics-service-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
django: Denial of service via unbounded caching of long language codes in get_supported_language_variant()
vendor_redhat·2026-10-06·CVSS 5.3
CVE-2026-77050 [MEDIUM] CWE-770 django: Denial of service via unbounded caching of long language codes in get_supported_language_variant()
django: Denial of service via unbounded caching of long language codes in get_supported_language_variant()
A flaw was found in Django. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by submitting requests containing numerous distinct, excessively long language codes. Because Django's translation component caches these codes in memory without length restrictions, continuous requests can exhaust available server memory and degrade application availability.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: ansible-automation-platform-24/controller-rhel8 (Red Hat
VulDB
djangoproject Django up to 5.2.17/6.0.8/6.1.1 Translation translation.py denial of service (Nessus ID 364197)
vuldb·2026-10-09·CVSS 5.3
CVE-2026-77050 [MEDIUM] djangoproject Django up to 5.2.17/6.0.8/6.1.1 Translation translation.py denial of service (Nessus ID 364197)
A vulnerability was found in djangoproject Django up to 5.2.17/6.0.8/6.1.1. It has been declared as problematic. This impacts the function django.utils.translation.get_supported_language_variant of the file django/utils/translation.py of the component Translation. Executing a manipulation can lead to denial of service.
This vulnerability is registered as CVE-2026-77050. It is possible to launch the attack remotely. No exploit is available.
It is recommended to upgrade the affected component.
GHSA
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
ghsa_unreviewed·2026-10-06
CVE-2026-77050 [MEDIUM] CWE-789 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is subject to
a potential denial-of-service attack when processing many distinct, very long
language codes, which are retained as keys in an in-memory cache and
consume process memory.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Gleb Lizunov for reporting this issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-77050 python-django6: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [fedora-all]
bugzilla·2026-10-07·CVSS 5.3
CVE-2026-77050 [MEDIUM] CVE-2026-77050 python-django6: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [fedora-all]
CVE-2026-77050 python-django6: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Django. The django.utils.translation.get_supported_language_variant() function used language codes as keys in an in-memory cache without first limiting their length. A remote, unauthenticated attacker could submit many distinct, very long language codes (for example via the Accept-Language HTTP header processed by Django's locale middleware) to grow this cache and consume excessive process memory over time.
Bugzilla
CVE-2026-77050 python-django4.2: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [epel-all]
bugzilla·2026-10-07·CVSS 5.3
CVE-2026-77050 [MEDIUM] CVE-2026-77050 python-django4.2: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [epel-all]
CVE-2026-77050 python-django4.2: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Django. The django.utils.translation.get_supported_language_variant() function used language codes as keys in an in-memory cache without first limiting their length. A remote, unauthenticated attacker could submit many distinct, very long language codes (for example via the Accept-Language HTTP header processed by Django's locale middleware) to grow this cache and consume excessive process memory over time.
Bugzilla
CVE-2026-77050 python-django5: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [fedora-all]
bugzilla·2026-10-07·CVSS 5.3
CVE-2026-77050 [MEDIUM] CVE-2026-77050 python-django5: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [fedora-all]
CVE-2026-77050 python-django5: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Django. The django.utils.translation.get_supported_language_variant() function used language codes as keys in an in-memory cache without first limiting their length. A remote, unauthenticated attacker could submit many distinct, very long language codes (for example via the Accept-Language HTTP header processed by Django's locale middleware) to grow this cache and consume excessive process memory over time.
Bugzilla
CVE-2026-77050 django: Denial of service via unbounded caching of long language codes in get_supported_language_variant()
bugzilla·2026-09-30·CVSS 5.3
CVE-2026-77050 [MEDIUM] CVE-2026-77050 django: Denial of service via unbounded caching of long language codes in get_supported_language_variant()
CVE-2026-77050 django: Denial of service via unbounded caching of long language codes in get_supported_language_variant()
A flaw was found in Django. The django.utils.translation.get_supported_language_variant() function used language codes as keys in an in-memory cache without first limiting their length. A remote, unauthenticated attacker could submit many distinct, very long language codes (for example via the Accept-Language HTTP header processed by Django's locale middleware) to grow this cache and consume excessive process memory over time. The upstream fix rejects or truncates language codes longer than 500 characters before the cached lookup. No confidentiality or integrity impact has been demonstrated.
https://docs.djangoproject.com/en/dev/releases/security/https://github.com/django/django/commit/02a69e3791e3df23d45ea4ea7e7fc489f0eef2behttps://github.com/django/django/commit/3d32ee80ae52745d686bf94d3555000ddf073267https://github.com/django/django/commit/7e878b0f8bd42260903e6a0d38996a93b0474a0bhttps://github.com/django/django/commit/c88b304cc2d90fc37d3bd1f5f3829706fa6c13bchttps://groups.google.com/g/django-announcehttps://www.djangoproject.com/weblog/2026/oct/06/security-releases/
2026-10-06
Published