{"id":"CVE-2019-14232","aliases":["ALPINE-CVE-2019-14232","DEBIAN-CVE-2019-14232","DLA-1872-1","DSA-4498-1","DSA-6136-1","EUVD-2019-0035","GHSA-c4qh-4vgv-qc6g","PYSEC-2019-11","RHSA-2020:1324","RHSA-2020:4390","SUSE-SU-2019:2180-1","SUSE-SU-2019:2257-1","SUSE-SU-2019:2335-1","UBUNTU-CVE-2019-14232","USN-4084-1","openSUSE-SU-2019:1839-1","openSUSE-SU-2019:1872-1","openSUSE-SU-2024:11205-1","openSUSE-SU-2024:13887-1","openSUSE-SU-2024:14208-1","openSUSE-SU-2026:10005-1","openSUSE-SU-2026:11235-1","openSUSE-SU-2026:11248-1","openSUSE-SU-2026:11270-1"],"status":"published","title":"Django Denial-of-service in django.utils.text.Truncator","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03531,"percentile":0.89343,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2019-08-01T10:00:00Z","modified":"2026-11-03T06:31:50Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.11.23","2.1.11","2.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.10","package":"py-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"py-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"py-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"py-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["3:3.2.25-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["2:2.2.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["2:2.2.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"python-django","fixed_in":["1.8.7-1ubuntu5.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-django","fixed_in":["1:1.11.11-1ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"python-django","fixed_in":["1:1.11.22-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11a1"},{"fixed":"1.11.23"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1a1"},{"fixed":"2.1.11"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2a1"},{"fixed":"2.2.4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.25-0+deb12u1"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.11-1+deb8u7"}]}],"versions":["1.7.10-1","1.7.11-1","1.7.11-1+deb8u1","1.7.11-1+deb8u2","1.7.11-1+deb8u3","1.7.11-1+deb8u4","1.7.11-1+deb8u5","1.7.11-1+deb8u6","1.7.7-1","1.7.7-1+deb8u1","1.7.7-1+deb8u2","1.7.7-1+deb8u3","1.7.7-1+deb8u4","1.7.7-1+deb8u5","1.7.9-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.7-2+deb9u6"}]}],"versions":["1:1.10.7-2","1:1.10.7-2+deb9u1","1:1.10.7-2+deb9u2","1:1.10.7-2+deb9u3","1:1.10.7-2+deb9u4","1:1.10.7-2+deb9u5"],"bundled":4},{"source":"osv","ecosystem":"Debian:10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.23-1~deb10u1"}]}],"versions":["1:1.11.21-1","1:1.11.22-1","1:1.11.22-1~deb10u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.25-0+deb12u1"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1"],"bundled":23},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11a1"},{"fixed":"1.11.23"}]}],"versions":["1.11","1.11.1","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.2","1.11.20","1.11.21","1.11.22","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.11a1","1.11b1","1.11rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1a1"},{"fixed":"2.1.11"}]}],"versions":["2.1","2.1.1","2.1.10","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.1.9","2.1a1","2.1b1","2.1rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2a1"},{"fixed":"2.2.4"}]}],"versions":["2.2","2.2.1","2.2.2","2.2.3","2.2a1","2.2b1","2.2rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11"},{"fixed":"1.11.23"},{"introduced":"2.1"},{"fixed":"2.1.11"},{"introduced":"2.2"},{"fixed":"2.2.4"}]}],"versions":["1.11","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.20","1.11.21","1.11.22","2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.1.9","2.1.10","2.2","2.2.1","2.2.2","2.2.3"]},{"source":"osv","ecosystem":"Red Hat:openstack:15::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-1.el8ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:15::el8","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-1.el8ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:15::el8","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-1.el8ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.27-1.el7ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.27-1.el7ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"python2-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.27-1.el7ost"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-3.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7","1.6.11-0ubuntu1.3+esm8","1.6.11-0ubuntu1.3+esm9","1.6.11-0ubuntu1.3+esm10","1.6.11-0ubuntu1.3+esm11","1.6.11-0ubuntu1.3+esm12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.10"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.5"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.22-1ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.10"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.5"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-lp151.2.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-bp151.3.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-2.3"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-2.1"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.14-1.1"}]}],"bundled":51},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-1.1"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-4.1"}]}],"bundled":59},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":49},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93}],"products":[{"vendor":"djangoblog_project","product":"djangoblog"},{"vendor":"djangoproject","product":"django"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs","tags":["x_transferred","web"]},{"url":"https://www.djangoproject.com/weblog/2019/aug/01/security-releases/","tags":["x_transferred","Vendor Advisory","advisory","article"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Aug/15","tags":["mailing-list","x_transferred","web"]},{"url":"https://www.debian.org/security/2019/dsa-4498","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190828-0002/","tags":["x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202004-17","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/04/6","tags":["mailing-list","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/04/1","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14232","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs","tags":["web"]},{"url":"https://github.com/pypa/advisory-db/tree/main/vulns/django/PYSEC-2019-11.yaml","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2023/10/04/6","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3LGJSPCN3VEG2UJPYCUB6TU75JTIV2TQ","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5XTP44JEOSNXRVW4JDZXA5XGMBDZLWSW","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190828-0002","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2019/aug/01/security-releases","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-11.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c4qh-4vgv-qc6g","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-14232","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14232","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1324","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724497","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734422","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1324.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-12781","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12781","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12781","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2019/jul/01/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14232","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14232","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14233","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14233","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14233","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14234","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14234","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14235","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14235","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4390","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4390.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192180-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1142880","tags":["report"]},{"url":"https://bugzilla.suse.com/1142882","tags":["report"]},{"url":"https://bugzilla.suse.com/1142883","tags":["report"]},{"url":"https://bugzilla.suse.com/1142885","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14235","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192257-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1136468","tags":["report"]},{"url":"https://bugzilla.suse.com/1139945","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192335-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14232","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4084-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14235","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3LGJSPCN3VEG2UJPYCUB6TU75JTIV2TQ/#3LGJSPCN3VEG2UJPYCUB6TU75JTIV2TQ","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5XTP44JEOSNXRVW4JDZXA5XGMBDZLWSW/#5XTP44JEOSNXRVW4JDZXA5XGMBDZLWSW","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14232","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","status":"published","published":"2019-08-02T00:00:00Z","modified":"2024-08-05T00:12:42.892Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2019-0035","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","status":"published","published":"2019-08-02T00:00:00Z","modified":"2024-08-05T00:12:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T02:40:40.581814Z"}],"ghsa":[{"id":"GHSA-c4qh-4vgv-qc6g","title":"Django Denial-of-service in django.utils.text.Truncator","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If `django.utils.text.Truncator`'s `chars()` and `words()` methods were passed the `html=True` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The `chars()` and `words()` methods are used to implement the `truncatechars_htm`l and `truncatewords_html` template filters, which were thus vulnerable.","status":"published","published":"2019-08-06T01:43:29Z","modified":"2024-09-20T16:15:23Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2019-14232","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","status":"published","published":"2019-08-02T15:15:11.88Z","modified":"2026-06-17T02:18:00.01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"ALPINE-CVE-2019-14232","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","status":"published","published":"2019-08-02T15:15:11.88Z","modified":"2026-11-03T06:31:50.024667235Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-14232","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","status":"published","published":"2019-08-02T15:15:11.88Z","modified":"2026-10-24T10:30:25.275226017Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14232","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","status":"published","published":"2019-08-02T15:15:11.88Z","modified":"2026-09-21T07:02:23.715235507Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-c4qh-4vgv-qc6g","title":"Django Denial-of-service in django.utils.text.Truncator","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If `django.utils.text.Truncator`'s `chars()` and `words()` methods were passed the `html=True` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The `chars()` and `words()` methods are used to implement the `truncatechars_htm`l and `truncatewords_html` template filters, which were thus vulnerable.","status":"published","published":"2019-08-06T01:43:29Z","modified":"2024-09-20T16:24:57.221275Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"RHSA-2020:1324","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-18T04:23:52Z","modified":"2026-06-28T10:35:46Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:4390","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-18T04:24:05Z","modified":"2026-06-28T10:40:12Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2019-14232","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","status":"published","published":"2019-08-01T10:00:00Z","modified":"2026-10-01T14:01:34.836060976Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-1872-1","title":"python-django - security update","status":"published","published":"2019-08-06T00:00:00Z","modified":"2026-03-09T01:21:25.375116Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4498-1","title":"python-django - security update","status":"published","published":"2019-08-12T00:00:00Z","modified":"2026-03-09T02:10:45.140647Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"DSA-6136-1","title":"python-django - security update","status":"published","published":"2026-02-15T00:00:00Z","modified":"2026-02-15T22:15:22.938868Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2019:1839-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-11358: Fixed prototype pollution.\n- CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-14232: Fixed denial-of-service possibility in ``django.utils.text.Truncator`` (bsc#1142880).\n- CVE-2019-14233: Fixed denial-of-service possibility in ``strip_tags()`` (bsc#1142882).\n- CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField`` (bsc#1142883).\n- CVE-2019-14235: Fixed potential memory exhaustion in ``django.utils.encoding.uri_to_iri()`` (bsc#1142885).\n\nNon-security issues fixed:\n\n- Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type.\n  ","status":"published","published":"2019-08-08T15:57:07Z","modified":"2026-02-04T02:34:28.956376Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1872-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-11358: Fixed prototype pollution.\n- CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-14232: Fixed denial-of-service possibility in ``django.utils.text.Truncator`` (bsc#1142880).\n- CVE-2019-14233: Fixed denial-of-service possibility in ``strip_tags()`` (bsc#1142882).\n- CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField`` (bsc#1142883).\n- CVE-2019-14235: Fixed potential memory exhaustion in ``django.utils.encoding.uri_to_iri()`` (bsc#1142885).\n\nNon-security issues fixed:\n\n- Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type.\n  \nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2019-08-14T09:13:06Z","modified":"2026-02-04T04:08:53.819357Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11205-1","title":"python36-Django-3.2.7-2.3 on GA media","description":"These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:14.367485Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13887-1","title":"python310-Django-4.2.11-2.1 on GA media","description":"These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:27.577316Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14208-1","title":"python310-Django4-4.2.14-1.1 on GA media","description":"These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-19T00:00:00Z","modified":"2026-02-04T02:20:42.476564Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:10005-1","title":"python312-Django6-6.0-1.1 on GA media","description":"These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-03T00:00:00Z","modified":"2026-03-23T04:54:19.792844Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11235-1","title":"python313-Django4-4.2.30-4.1 on GA media","description":"These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.244458214Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11248-1","title":"python313-Django-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-11T09:15:07.179829219Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2019-11","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","status":"published","published":"2019-08-02T15:15:00Z","modified":"2023-11-08T04:01:09.281488Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-SU-2019:2180-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).\n- CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).\n- CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).\n- CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).\n","status":"published","published":"2019-08-19T14:48:36Z","modified":"2026-02-04T03:26:47.803093Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2257-1","title":"Security update for python-Django","description":"This update for python-Django to version 1.11.23 fixes the following issues:\n\n- CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).\n- CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).\n- CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).\n- CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-12308: Fixed a cross site scripting vulnerability in the AdminURLFieldWidget (bsc#1136468).\n","status":"published","published":"2019-09-02T07:03:33Z","modified":"2026-02-04T03:40:58.849461Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2335-1","title":"Security update for python-Django1","description":"This update for python-Django1 to version 1.11.23 fixes the following issues:\n\n- CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).\n- CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).\n- CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).\n- CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-12308: Fixed a cross site scripting vulnerability in the AdminURLFieldWidget (bsc#1136468).\n","status":"published","published":"2019-09-09T10:09:00Z","modified":"2026-02-04T02:25:54.98095Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4084-1","title":"python-django vulnerabilities","description":"It was discovered that Django incorrectly handled the Truncator function. A\nremote attacker could possibly use this issue to cause Django to consume\nresources, leading to a denial of service. (CVE-2019-14232)\n\nIt was discovered that Django incorrectly handled the strip_tags function.\nA remote attacker could possibly use this issue to cause Django to consume\nresources, leading to a denial of service. (CVE-2019-14233)\n\nIt was discovered that Django incorrectly handled certain lookups in the\nPostgreSQL support. A remote attacker could possibly use this issue to\nperform SQL injection attacks. (CVE-2019-14234)\n\nIt was discovered that Django incorrectly handled certain invalid UTF-8\noctet sequences. A remote attacker could possibly use this issue to cause\nDjango to consume resources, leading to a denial of service.\n(CVE-2019-14235)\n","status":"published","published":"2019-08-01T11:59:17Z","modified":"2026-04-27T15:27:31.260017Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}