CVE-2009-3695
Django Regex Algorithmic Complexity Causes Denial of Service
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
Exploit likelihood
What each source reports
NVD Score used
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
- Record
CVE-2009-3695- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
- Record
CVE-2009-3695- Updated
- 2026-11-02
EUVDEUVD-2009-0004 No score
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
- Record
EUVD-2009-0004- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p6m5-h7pp-v2x5
Django Regex Algorithmic Complexity Causes Denial of Service
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
- Record
GHSA-p6m5-h7pp-v2x5- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-1333
- Updated
- 2026-11-02
OSVGHSA-p6m5-h7pp-v2x5
Django Regex Algorithmic Complexity Causes Denial of Service
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
- Record
GHSA-p6m5-h7pp-v2x5- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333, CWE-400
- Updated
- 2026-11-02
OSV No score
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
- Record
CVE-2009-3695- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3695 No score
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
- Record
DEBIAN-CVE-2009-3695- Updated
- 2026-11-02
OSVPYSEC-2009-4 No score
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
- Record
PYSEC-2009-4- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
1.0 up to 1.0.4 | 1.0.4 |
djangoPyPI |
1.1 up to 1.1.1 | 1.1.1 |
python-djangoDebian:12 |
before 1.1.1-1 | 1.1.1-1 |
python-djangoDebian:13 |
before 1.1.1-1 | 1.1.1-1 |
python-djangoDebian:14 |
before 1.1.1-1 | 1.1.1-1 |
python-djangoDebian:5.0 |
before 1.0.2-1+lenny2, plus listed versions 1.0.2-11.0.2-1+lenny1 |
1.0.2-1+lenny2 |
djangoPyPI |
1.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3 |
1.0.4 |
djangoPyPI |
1.0 up to 1.0.4, 1.1 up to 1.1.1, plus listed versions 1.0.11.0.21.0.3 |
1.0.41.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3695 is a medium vulnerability (CVSS 5.0) in Djangoproject Django, published October 10, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.79%, the 90th percentile. Fixed in django 1.0.4.
References
securityfocus.com/bid/36655
exchange.xforce.ibmcloud.com/vulnerabilities/53727
djangoproject.com/weblog/2009/oct/09/security
secunia.com/advisories/36948
debian.org/security/2009/dsa-1905
Show 14 moreShow less
groups.google.com/group/django-users/browse_thread/thread/15df9e45118dfc51
bugs.debian.org/cgi-bin/bugreport.cgi?bug=550457
openwall.com/lists/oss-security/2009/10/13/6
vupen.com/english/advisories/2009/2871
nvd.nist.gov/vuln/detail/CVE-2009-3695
web.archive.org/web/20200228171918/http://www.securityfocus.com/bid/36655
github.com/django/django/commit/594a28a9044120bed58671dde8a805c9e0f6c79a
security-tracker.debian.org/tracker/CVE-2009-3695