CVE-2025-32873Medium· 5.3▾ TwilightPoC availableDjango has a denial-of-service possibility in strip_tags()
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 2.7 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
14%
1 GitHub repo (last check)
An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().
django >= 4.2, < 4.2.21django >= 5.1, < 5.1.9django >= 5.2, < 5.2.1Upgrade to a patched release:
django 4.2.21django 5.1.9django 5.2.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-64458High· 7.5Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
CVE-2025-57833High· 7.1Django is subject to SQL injection through its column aliases
CVE-2026-33033Medium· 6.5Django has potential DoS via MultiPartParser through crafted multipart uploads
CVE-2026-1312Medium· 5.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, w…
CVE-2026-1207Medium· 5.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupport…
CVE-2026-5766Medium· 5.3Django has an Improper Handling of Length Parameter Inconsistency