{"id":"CVE-2020-15225","aliases":["DEBIAN-CVE-2020-15225","EUVD-2021-0053","GHSA-x7gm-rfgv-w973","MGASA-2021-0511","PYSEC-2021-64","UBUNTU-CVE-2020-15225"],"status":"published","title":"Denial of Service vulnerability in django-filter","description":"django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01797,"percentile":0.78608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-681"],"published":"2020-09-28T19:05:29Z","modified":"2026-10-26T12:00:23Z","fixes":[{"ecosystem":"PyPI","package":"django-filter","fixed_in":["2.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"django-filter","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"django-filter","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"django-filter","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-django-filter","fixed_in":["2.4.0-1.mga8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}],"versions":["0.1.0","0.10.0","0.11.0","0.12.0","0.13.0","0.14.0","0.15.0","0.15.1","0.15.2","0.15.3","0.2.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.6","0.6a1","0.7","0.8","0.9.0","0.9.1","0.9.2","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","2.0.0","2.0.0.dev1","2.1.0","2.2.0","2.3.0"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.mga8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django-filter","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"340cf7a23a2b3dcd7183f6a0d6c383e85b130d2b"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}],"versions":["0.1.0","0.2.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.6a1","0.6","0.7","0.8","0.9.0","0.9.1","0.9.2","0.10.0","0.11.0","0.12.0","0.13.0","0.14.0","0.15.0","0.15.1","0.15.2","0.15.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","2.0.0.dev1","2.0.0","2.1.0","2.2.0","2.3.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1","0.11.0-1","0.11.0-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.4-1","1.0.4-2","1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.2-3","23.3post1-1","23.4-1","23.5-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1-1","25.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"django-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1-2"]}],"products":[{"vendor":"carltongibson","product":"django-filter"},{"vendor":"django-filter_project","product":"django-filter"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/carltongibson/django-filter/security/advisories/GHSA-x7gm-rfgv-w973","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/carltongibson/django-filter/commit/340cf7a23a2b3dcd7183f6a0d6c383e85b130d2b","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/carltongibson/django-filter/releases/tag/2.4.0","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://pypi.org/project/django-filter/","tags":["x_transferred","Product","Third Party Advisory","package","report"]},{"url":"https://security.netapp.com/advisory/ntap-20210604-0010/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPHENTRHRAYFXYPPBT7JRHZRWILRY44S/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FAT2ZAEF6DM3VFSOHKB7X3ASSHGQHJAK/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVJ7AYU6FUSU3F653YCGW5LFD3IULRSX/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15225","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django-filter/PYSEC-2021-64.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPHENTRHRAYFXYPPBT7JRHZRWILRY44S","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAT2ZAEF6DM3VFSOHKB7X3ASSHGQHJAK","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVJ7AYU6FUSU3F653YCGW5LFD3IULRSX","tags":["web"]},{"url":"https://pypi.org/project/django-filter","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210604-0010","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x7gm-rfgv-w973"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15225","tags":["advisory"]},{"url":"https://github.com/carltongibson/django-filter","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0511.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29603","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DPHENTRHRAYFXYPPBT7JRHZRWILRY44S/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-15225","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15225","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-15225","title":"Denial of Service vulnerability in django-filter","description":"django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.","status":"published","published":"2021-04-29T00:00:00Z","modified":"2024-08-04T13:08:22.886Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-681"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2021-0053","description":"django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.","status":"published","published":"2021-04-29T00:00:00Z","modified":"2024-08-04T13:08:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-x7gm-rfgv-w973","title":"Potential DoS with NumberFilter conversion to integer values.","description":"### Impact\n\nAutomatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. \n\n### Patches\n\nVersion 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. \n\nIn addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. \n\n### Workarounds\n\nUsers may manually apply an equivalent validator if they are not able to upgrade.  \n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the django-filter repo](https://github.com/carltongibson/django-filter)\n\nThanks to Marcin Waraksa for the report. \n","status":"published","published":"2020-09-28T19:05:29Z","modified":"2024-09-16T22:10:02Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-681"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2020-15225","description":"django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.","status":"published","published":"2021-04-29T21:15:08.49Z","modified":"2026-06-17T02:56:18.477Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-681"],"updated_at":"2026-11-02T14:06:39.25999Z"}],"osv":[{"id":"CVE-2020-15225","description":"django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.","status":"published","published":"2021-04-29T21:15:08.49Z","modified":"2026-10-20T10:51:54.052442709Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-15225","description":"django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.","status":"published","published":"2021-04-29T21:15:08.49Z","modified":"2026-10-26T12:00:23.118507508Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"GHSA-x7gm-rfgv-w973","title":"Potential DoS with NumberFilter conversion to integer values.","description":"### Impact\n\nAutomatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. \n\n### Patches\n\nVersion 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. \n\nIn addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. \n\n### Workarounds\n\nUsers may manually apply an equivalent validator if they are not able to upgrade.  \n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the django-filter repo](https://github.com/carltongibson/django-filter)\n\nThanks to Marcin Waraksa for the report. \n","status":"published","published":"2020-09-28T19:05:29Z","modified":"2026-07-08T06:27:58.269813345Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-681"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"UBUNTU-CVE-2020-15225","description":"django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.","status":"published","published":"2021-04-29T21:15:00Z","modified":"2026-10-17T12:56:11.314188751Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"MGASA-2021-0511","title":"Updated python-django-filter packages fix security vulnerability","description":"In django-filter before version 2.4.0, automatically generated 'NumberFilter'\ninstances, whose value was later converted to an integer, were subject to\npotential DoS from maliciously input using exponential format with\nsufficiently large exponents.\n","status":"published","published":"2021-11-18T21:50:59Z","modified":"2026-04-16T04:41:59.246116739Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"PYSEC-2021-64","description":"django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.","status":"published","published":"2021-04-29T21:15:00Z","modified":"2023-11-08T04:02:34.315369Z","updated_at":"2026-11-02T15:52:53.119977Z"}]}}