{"id":"CVE-2015-2316","aliases":["DEBIAN-CVE-2015-2316","EUVD-2015-0007","GHSA-j3j3-jrfh-cm2w","MGASA-2015-0127","PYSEC-2015-18","SUSE-SU-2015:0563-1","SUSE-SU-2015:0694-1","SUSE-SU-2015:0695-1","SUSE-SU-2015:1109-1","SUSE-SU-2015:1112-1","UBUNTU-CVE-2015-2316","USN-2539-1"],"status":"published","title":"Django Denial-of-service possibility with strip_tags","description":"The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04826,"percentile":0.92047,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399","CWE-770"],"published":"2014-09-03T15:51:02Z","modified":"2026-09-09T06:47:23Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.6.11","1.7.7","1.8c1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1.7.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1.7.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1.7.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.11"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7.7"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8a1"},{"fixed":"1.8c1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.11"}]}],"versions":["1.6","1.6.1","1.6.10","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7.7"}]}],"versions":["1.7","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8a1"},{"fixed":"1.8c1"}]}],"versions":["1.8a1","1.8b1","1.8b2"]},{"source":"osv","ecosystem":"Mageia:4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.9-1.2.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"python-django14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-1.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.11"},{"introduced":"1.7"},{"fixed":"1.7.7"},{"introduced":"1.8a0"},{"fixed":"1.8c1"}]}],"versions":["1.6","1.6.1","1.6.10","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.8a1","1.8b1","1.8b2"]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 1.0","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 1.0","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.8"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.8"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6"],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"djangoproject","product":"django"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"oracle","product":"solaris"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2539-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/73322","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.djangoproject.com/weblog/2015/mar/18/security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2316","tags":["advisory"]},{"url":"https://web.archive.org/web/20200229033201/http://www.securityfocus.com/bid/73322","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2015/mar/18/security-releases","tags":["web"]},{"url":"https://github.com/django/django/commit/5447709a571cd5d95971f1d5d21d4a7edcf85bbd","tags":["web"]},{"url":"https://github.com/django/django/commit/b6b3cb9899214a23ebb0f4ebf0e0b300b0ee524f","tags":["web"]},{"url":"https://github.com/django/django/commit/e63363f8e075fa8d66326ad6a1cc3391cc95cd97","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-18.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j3j3-jrfh-cm2w","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-2316","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0127.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15528","tags":["report"]},{"url":"https://www.djangoproject.com/weblog/2015/mar/09/security-releases/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/893087","tags":["report"]},{"url":"https://bugzilla.suse.com/893088","tags":["report"]},{"url":"https://bugzilla.suse.com/893089","tags":["report"]},{"url":"https://bugzilla.suse.com/893090","tags":["report"]},{"url":"https://bugzilla.suse.com/913053","tags":["report"]},{"url":"https://bugzilla.suse.com/913054","tags":["report"]},{"url":"https://bugzilla.suse.com/913055","tags":["report"]},{"url":"https://bugzilla.suse.com/913056","tags":["report"]},{"url":"https://bugzilla.suse.com/914706","tags":["report"]},{"url":"https://bugzilla.suse.com/923176","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2317","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150694-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/923172","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150695-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151109-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151112-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-2316","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2539-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-2317","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-2316","description":"The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.","status":"published","published":"2015-03-25T14:00:00Z","modified":"2024-08-06T05:10:16.424Z","updated_at":"2026-11-02T14:35:41.621934Z"}],"euvd":[{"id":"EUVD-2015-0007","description":"The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.","status":"published","published":"2015-03-25T14:00:00Z","modified":"2024-08-06T05:10:16Z","updated_at":"2026-11-03T02:22:12.40366Z"}],"ghsa":[{"id":"GHSA-j3j3-jrfh-cm2w","title":"Django Denial-of-service possibility with strip_tags","description":"The `utils.html.strip_tags` function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.","status":"published","published":"2022-05-14T02:06:52Z","modified":"2024-09-18T16:03:04Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2015-2316","description":"The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.","status":"published","published":"2015-03-25T14:59:02.94Z","modified":"2026-06-17T00:23:54.673Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"GHSA-j3j3-jrfh-cm2w","title":"Django Denial-of-service possibility with strip_tags","description":"The `utils.html.strip_tags` function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.","status":"published","published":"2022-05-14T02:06:52Z","modified":"2024-09-18T16:08:36.203371Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"CVE-2015-2316","description":"The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.","status":"published","published":"2015-03-25T14:59:02Z","modified":"2026-04-16T06:20:31.021690025Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-2316","description":"The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.","status":"published","published":"2015-03-25T14:59:02.94Z","modified":"2026-09-09T06:47:23.669359131Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0127","title":"Updated python-django packages fix security vulnerabilities","description":"Updated python-django and python-django14 packages fix security\nvulnerabilities:\n\nThe ModelAdmin.readonly_fields attribute in the Django admin allows\ndisplaying model fields and model attributes. While the former were correctly\nescaped, the latter were not. Thus untrusted content could be injected into\nthe admin, presenting an exploitation vector for XSS attacks (CVE-2015-2241).\n\nDjango relies on user input in some cases to redirect the user to an \"on\nsuccess\" URL. The security checks for these redirects accepted URLs with\nleading control characters and so considered URLs like \\x08javascript:...\nsafe. This issue doesn't affect Django currently, however, if a developer\nrelies on is_safe_url() to provide safe redirect targets and puts such a URL\ninto a link, they could suffer from an XSS attack as some browsers such as\nGoogle Chrome ignore control characters at the start of a URL in an anchor\nhref (CVE-2015-2317).\n\nNote that the CVE-2015-2241 issue does not affect python-django14 directly,\nbut client code using it may be affected.  Please see the March 9th upstream\nadvisory for more information on this.\n","status":"published","published":"2015-04-03T13:11:23Z","modified":"2026-04-16T06:24:06.141571818Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"PYSEC-2015-18","description":"The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.","status":"published","published":"2015-03-25T14:59:00Z","modified":"2026-06-10T17:00:57.378565727Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2015:0563-1","title":"Security update for python-django","description":"\npython-django was updated to 1.5.10 fixing bugs and security issues:\n\n    * Prevented reverse() from generating URLs pointing to other hosts to\n      prevent phishing attacks. (bnc#893087, CVE-2014-0480)\n    * Removed O(n) algorithm when uploading duplicate file names to fix\n      file upload denial of service. (bnc#893088, CVE-2014-0481)\n    * Modified RemoteUserMiddleware to logout on REMOTE_USE change to\n      prevent session hijacking. (bnc#893089, CVE-2014-0482)\n    * Prevented data leakage in contrib.admin via query string\n      manipulation. (bnc#893090, CVE-2014-0483)\n\nSecurity Issues:\n\n    * CVE-2014-0480\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480\u003e\n    * CVE-2014-0481\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481\u003e\n    * CVE-2014-0482\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482\u003e\n    * CVE-2014-0483\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483\u003e\n\n","status":"published","published":"2014-09-03T15:51:02Z","modified":"2026-02-04T02:24:37.285672Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0694-1","title":"Security update for python-Django","description":"\npython-Django has been updated to fix two vulnerabilities:\n\n    * URLs starting with control characters could have allowed XSS\n      (cross-site-scripting) attacks via user-supplied redirect URLs\n      (CVE-2015-2317)\n    * An infinite loop possibility could be triggered in the strip_tags()\n      function, which allowed denial of service attacks (CVE-2015-2316)\n\nSecurity Issues:\n\n    * CVE-2015-2316\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2316\u003e\n    * CVE-2015-2317\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2317\u003e\n\n","status":"published","published":"2015-03-25T23:21:02Z","modified":"2026-02-04T03:34:17.265825Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0695-1","title":"Security update for python-django","description":"\npython-django was updated to 1.5.10 fixing bugs and security issues:\n\n    * Prevented reverse() from generating URLs pointing to other hosts to\n      prevent phishing attacks. (bnc#893087, CVE-2014-0480)\n    * Removed O(n) algorithm when uploading duplicate file names to fix\n      file upload denial of service. (bnc#893088, CVE-2014-0481)\n    * Modified RemoteUserMiddleware to logout on REMOTE_USE change to\n      prevent session hijacking. (bnc#893089, CVE-2014-0482)\n    * Prevented data leakage in contrib.admin via query string\n      manipulation. (bnc#893090, CVE-2014-0483)\n\nSecurity Issues:\n\n    * CVE-2014-0480\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480\u003e\n    * CVE-2014-0481\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481\u003e\n    * CVE-2014-0482\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482\u003e\n    * CVE-2014-0483\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483\u003e\n\n","status":"published","published":"2014-09-03T15:51:02Z","modified":"2026-02-04T02:17:29.821596Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1109-1","title":"Security update for python-Django","description":"python-django was updated to 1.6.11 to fix security issues and non-security bugs.\n\nThe following vulnerabilities were fixed:\n\n* Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)\n* Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)\n* WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)\n* Mitigated possible XSS attack via user-supplied redirect URLs\n* Denial-of-service attack against ``django.views.static.serve``   (bnc#913056, CVE-2015-0221)\n* Database denial-of-service with ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222)\n\nThe update also contains fixes for non-security bugs, functional and stability issues.\n","status":"published","published":"2015-03-30T09:04:33Z","modified":"2026-02-04T03:52:43.807161Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1112-1","title":"Security update for python-Django","description":"python-django was updated to 1.6.11 to fix security issues and non-security bugs.\n\nThe following vulnerabilities were fixed:\n\n* Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)\n* Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)\n* WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)\n* Mitigated possible XSS attack via user-supplied redirect URLs\n* Denial-of-service attack against ``django.views.static.serve``   (bnc#913056, CVE-2015-0221)\n* Database denial-of-service with ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222)\n\nThe update also contains fixes for non-security bugs, functional and stability issues.\n","status":"published","published":"2015-03-30T09:04:33Z","modified":"2026-02-04T04:29:25.747143Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-2316","description":"The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.","status":"published","published":"2015-03-19T00:00:00Z","modified":"2026-02-04T04:17:15.252461Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2539-1","title":"python-django vulnerabilities","description":"Andrey Babak discovered that Django incorrectly handled strip_tags. A\nremote attacker could possibly use this issue to cause Django to enter an\ninfinite loop, resulting in a denial of service. This issue only affected\nUbuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-2316)\n\nDaniel Chatfield discovered that Django incorrectly handled user-supplied\nredirect URLs. A remote attacker could possibly use this issue to perform a\ncross-site scripting attack. (CVE-2015-2317)\n","status":"published","published":"2015-03-23T19:02:31Z","modified":"2026-02-10T04:40:53Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}