{"id":"CVE-2025-26699","kind":"vulnerability","aliases":["CVE-2025-26699","GHSA-p3fp-8748-vqfq"],"related":[],"title":"Django Vulnerable to Allocation of Resources Without Limits or Throttling","description":"An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.","summary":"Django's django.utils.text.wrap() and the wordwrap template filter can consume excessive resources when given very long strings. An attacker who can get such input rendered can cause a denial of service.","severity":"medium","cvss":5.0,"epss":0.0083,"exploited":false,"exploited_at":null,"products":[{"name":"Django","fixed":["4.2.20"],"affected":">= 4.2, < 4.2.20","ecosystem":"pypi"},{"name":"Django","fixed":["5.0.13"],"affected":">= 5.0, < 5.0.13","ecosystem":"pypi"},{"name":"Django","fixed":["5.1.7"],"affected":">= 5.1, < 5.1.7","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-770","django","package","python","web-apps"],"not_affected_if":["fixed-version","no-user-input-wrapped"],"how_to_check":"- Check the installed Django version with `python -m django --version`.\n- Search templates and code for uses of the `wordwrap` filter or `django.utils.text.wrap` on user-supplied input.","fix":"- Upgrade to `4.2.20` on the 4.2 line.\n- Upgrade to `5.0.13` on the 5.0 line.\n- Upgrade to `5.1.7` on the 5.1 line.","status":"open","published_at":"2025-03-06T21:31:26+00:00","first_seen_at":"2026-11-04T22:34:04+00:00","triaged_at":"2026-11-04T22:35:15+00:00","updated_at":"2026-11-04T22:35:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T22:35:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `4.2.20` on the 4.2 line.\n- Upgrade to `5.0.13` on the 5.0 line.\n- Upgrade to `5.1.7` on the 5.1 line.","reach":"internet","title":"Django: wordwrap and wrap functions can be stalled by very long strings","impact":"low","summary":"Django's django.utils.text.wrap() and the wordwrap template filter can consume excessive resources when given very long strings. An attacker who can get such input rendered can cause a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["django","python","web-apps"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Requests exhaust CPU and memory, causing service slowdown or outage","analyst_note":"","how_to_check":"- Check the installed Django version with `python -m django --version`.\n- Search templates and code for uses of the `wordwrap` filter or `django.utils.text.wrap` on user-supplied input.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-user-input-wrapped"],"who_is_affected":"Applications built on Django 4.2 before 4.2.20, 5.0 before 5.0.13, or 5.1 before 5.1.7 that call wrap() or use the wordwrap filter on very long user-supplied strings. Sites that never pass untrusted text through these functions are much less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000702,"input_tokens":4273,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,20A '-26699':13A,21A '-770':26B '4.2':77C '4.2.20':79C '5.0':73C '5.0.13':75C '5.1':70C '5.1.7':72C '8748':17A 'alloc':4A 'app':32B 'attack':51B,96C 'caus':59B 'consum':42B 'cve':11A,19A 'cwe':25B 'denial':61B,93C 'denial-of-servic':92C 'discov':67C 'django':1A,22A,23A,24A,27B,33B,69C 'django.utils.text.wrap':35B,81C 'excess':43B 'filter':40B,86C 'get':54B 'ghsa':15A 'ghsa-p3fp':14A 'given':46B 'input':56B 'issu':65C 'limit':8A 'long':48B,101C 'method':82C 'p3fp':16A 'packag':28B 'potenti':91C 'python':29B 'render':57B 'resourc':6A,44B 'servic':63B,95C 'string':49B,102C 'subject':88C 'templat':39B,85C 'throttl':10A 'use':98C 'vqfq':18A 'vulner':2A 'web':31B 'web-app':30B 'without':7A 'wordwrap':38B,84C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Django 4.2 before 4.2.20, 5.0 before 5.0.13, or 5.1 before 5.1.7 that call wrap() or use the wordwrap filter on very long user-supplied strings. Sites that never pass untrusted text through these functions are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["django"],"ptokens":["django"],"labels":["cwe770","django","medium","package","pypi","python","webapps"],"campaign_type":null,"first_public_at":"2025-03-06T21:31:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-p3fp-8748-vqfq","url":"https://github.com/advisories/GHSA-p3fp-8748-vqfq","severity":"medium","published_at":"2025-03-06T21:31:26+00:00","modified_at":"2026-11-04T22:28:52+00:00","first_seen_at":"2026-11-04T22:34:04+00:00","fetched_at":"2026-11-04T22:53:47+00:00","note":null}],"documents":[{"id":70950,"url":"https://github.com/django/django/commit/4f2765232336b8ad0afd8017d9d912ae93470017","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70951,"url":"https://github.com/django/django/commit/8dbb44d34271637099258391dfc79df33951b841","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70952,"url":"https://github.com/django/django/commit/e88f7376fe68dbf4ebaf11fad1513ce700b45860","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.0083,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-26699"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}