{"id":"CVE-2024-53907","aliases":["GHSA-8498-2h75-472j","BIT-django-2024-53907","PYSEC-2024-156"],"title":"Django denial-of-service in django.utils.html.strip_tags()","summary":"Django denial-of-service in django.utils.html.strip_tags()","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"django","product":"django","ecosystem":"pip","affected":["django >= 5.1.0, < 5.1.4","django >= 4.2.0, < 4.2.17","django >= 5.0.0, < 5.0.10","django >= 5.1, < 5.1.4","django >= 5.0, < 5.0.10","django >= 4.2, < 4.2.17"],"patched":["django 5.1.4","django 4.2.17","django 5.0.10","django 5.1.4","django 5.0.10","django 4.2.17"],"published":"2024-12-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:56.451814675Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8498-2h75-472j","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53907"},{"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"url":"https://github.com/django/django"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-156.yaml"},{"url":"https://groups.google.com/g/django-announce"},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html"},{"url":"https://www.djangoproject.com/weblog/2024/dec/04/security-releases"},{"url":"https://www.openwall.com/lists/oss-security/2024/12/04/3"}],"tags":["osv","pip"],"epss":0.01388,"epssPercentile":0.71085,"ingestedAt":"2026-09-12T03:13:01.675Z","slug":"CVE-2024-53907","body":"## Overview\n\nAn issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.\n\n## Affected packages\n\n- `django >= 5.1.0, < 5.1.4`\n- `django >= 4.2.0, < 4.2.17`\n- `django >= 5.0.0, < 5.0.10`\n- `django >= 5.1, < 5.1.4`\n- `django >= 5.0, < 5.0.10`\n- `django >= 4.2, < 4.2.17`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `django 5.1.4`\n- `django 4.2.17`\n- `django 5.0.10`\n- `django 5.1.4`\n- `django 5.0.10`\n- `django 4.2.17`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}