---
id: "CVE-2025-26699"
kind: "vulnerability"
aliases: ["CVE-2025-26699", "GHSA-p3fp-8748-vqfq"]
title: "Django Vulnerable to Allocation of Resources Without Limits or Throttling"
severity: "medium"
cvss: 5.0
epss: 0.0083
exploited: false
status: "open"
category: "package"
products: [{"name": "Django", "fixed": ["4.2.20"], "affected": ">= 4.2, < 4.2.20", "ecosystem": "pypi"}, {"name": "Django", "fixed": ["5.0.13"], "affected": ">= 5.0, < 5.0.13", "ecosystem": "pypi"}, {"name": "Django", "fixed": ["5.1.7"], "affected": ">= 5.1, < 5.1.7", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-770", "django", "package", "python", "web-apps"]
not_affected_if: ["fixed-version", "no-user-input-wrapped"]
published_at: "2025-03-06T21:31:26+00:00"
first_seen_at: "2026-11-04T22:34:04+00:00"
updated_at: "2026-11-04T22:35:15+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-p3fp-8748-vqfq", "first_seen_at": "2026-11-04T22:34:04+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.0083, "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-26699"}]
---

# Django Vulnerable to Allocation of Resources Without Limits or Throttling

Django's django.utils.text.wrap() and the wordwrap template filter can consume excessive resources when given very long strings. An attacker who can get such input rendered can cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:Django affected >= 4.2, < 4.2.20 fixed 4.2.20
- pypi:Django affected >= 5.0, < 5.0.13 fixed 5.0.13
- pypi:Django affected >= 5.1, < 5.1.7 fixed 5.1.7

## How to check

- Check the installed Django version with `python -m django --version`.
- Search templates and code for uses of the `wordwrap` filter or `django.utils.text.wrap` on user-supplied input.

## Fix

- Upgrade to `4.2.20` on the 4.2 line.
- Upgrade to `5.0.13` on the 5.0 line.
- Upgrade to `5.1.7` on the 5.1 line.

## Timeline

- 2026-11-04T22:34:04+00:00 ghsa https://github.com/advisories/GHSA-p3fp-8748-vqfq

## Documents

- [fix] Patch: github.com https://github.com/django/django/commit/4f2765232336b8ad0afd8017d9d912ae93470017
- [fix] Patch: github.com https://github.com/django/django/commit/8dbb44d34271637099258391dfc79df33951b841
- [fix] Patch: github.com https://github.com/django/django/commit/e88f7376fe68dbf4ebaf11fad1513ce700b45860

## From the sources

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_