{"id":"CVE-2024-38875","aliases":["GHSA-qg2p-9jwr-mmqf","BIT-django-2024-38875","PYSEC-2024-56"],"title":"Django vulnerable to Denial of Service","summary":"Django vulnerable to Denial of Service","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"django","product":"django","ecosystem":"pip","affected":["django >= 4.2, < 4.2.14","django >= 5.0, < 5.0.7"],"patched":["django 4.2.14","django 5.0.7"],"published":"2024-07-10","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:16.815693765Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-qg2p-9jwr-mmqf","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38875"},{"url":"https://github.com/django/django/commit/7285644640f085f41d60ab0c8ae4e9153f0485db"},{"url":"https://github.com/django/django/commit/79f368764295df109a37192f6182fb6f361d85b5"},{"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"url":"https://github.com/django/django"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-56.yaml"},{"url":"https://groups.google.com/forum/#%21forum/django-announce"},{"url":"https://security.netapp.com/advisory/ntap-20240808-0005"},{"url":"https://www.djangoproject.com/weblog/2024/jul/09/security-releases"}],"tags":["osv","pip"],"epss":0.01187,"epssPercentile":0.66008,"ingestedAt":"2026-09-12T03:13:01.721Z","slug":"CVE-2024-38875","body":"## Overview\n\nAn issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.\n\n## Affected packages\n\n- `django >= 4.2, < 4.2.14`\n- `django >= 5.0, < 5.0.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `django 4.2.14`\n- `django 5.0.7`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}