{"id":"CVE-2024-41990","aliases":["ALPINE-CVE-2024-41990","BIT-django-2024-41990","CLSA-2025-1759450296","CLSA-2026-1792397200","DEBIAN-CVE-2024-41990","EUVD-2024-0045","GHSA-795c-9xpc-xw6g","MGASA-2025-0039","OESA-2024-2002","OESA-2024-2003","OESA-2024-2004","OESA-2024-2036","OESA-2024-2280","PYSEC-2024-68","RHSA-2024:6428","RHSA-2025:1335","SUSE-SU-2024:2816-1","SUSE-SU-2024:2817-1","SUSE-SU-2024:2861-1","UBUNTU-CVE-2024-41990","USN-6946-1","openSUSE-SU-2024:0272-1","openSUSE-SU-2024:14247-1","openSUSE-SU-2024:14248-1","openSUSE-SU-2026:10005-1","openSUSE-SU-2026:11235-1","openSUSE-SU-2026:11248-1","openSUSE-SU-2026:11270-1"],"status":"published","title":"Django vulnerable to a denial-of-service attack","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01258,"percentile":0.69787,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-130"],"published":"2024-08-06T13:00:00Z","modified":"2026-11-03T06:32:08Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["5.0.8","4.2.15"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-django","fixed_in":["4.2.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-django","fixed_in":["4.2.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-django","fixed_in":["4.2.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["4.2.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["4.2.16-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["4.2.15","5.0.8"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"django","fixed_in":["5.0.post5+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["3:4.2.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["3:4.2.15-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-Django","fixed_in":["2.0.7-150000.1.30.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","fixed_in":["1:1.11.11-1ubuntu1.21+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"python-django","fixed_in":["2:2.2.12-1ubuntu0.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-django","fixed_in":["2:3.2.12-2ubuntu1.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-django","fixed_in":["3:4.2.11-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.15"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.0"},{"fixed":"4.2.15"},{"introduced":"5.0.0"},{"fixed":"5.0.8"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.post5+tuxcare"}]}],"versions":["5.0","5.0.post1+tuxcare","5.0.post2+tuxcare","5.0.post3+tuxcare","5.0.post4+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.post18+tuxcare"}]}],"versions":["4.2","4.2.post1+tuxcare","4.2.post10+tuxcare","4.2.post11+tuxcare","4.2.post12+tuxcare","4.2.post13+tuxcare","4.2.post14+tuxcare","4.2.post15+tuxcare","4.2.post16+tuxcare","4.2.post17+tuxcare","4.2.post2+tuxcare","4.2.post3+tuxcare","4.2.post4+tuxcare","4.2.post5+tuxcare","4.2.post6+tuxcare","4.2.post7+tuxcare","4.2.post8+tuxcare","4.2.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1","3:3.2.25-0+deb12u1","3:3.2.25-0+deb12u2","3:3.2.25-0+deb12u3","3:3.2.25-0+deb12u4","3:3.2.25-0+deb12u5","3:3.2.25-0+deb12u6","3:4.1-1","3:4.1.1-1","3:4.1.2-1","3:4.1.3-1","3:4.1.4-1","3:4.1.5-1","3:4.2-1","3:4.2.1-1","3:4.2.10-1","3:4.2.11-1","3:4.2.13-1","3:4.2.14-1","3:4.2.15-1","3:4.2.15-1~bpo12+1","3:4.2.16-1","3:4.2.17-1","3:4.2.17-2","3:4.2.18-1","3:4.2.18-1~bpo12+1","3:4.2.19-1","3:4.2.19-1~bpo12+1","3:4.2.2-1","3:4.2.20-1","3:4.2.20-1~bpo12+1","3:4.2.21-1","3:4.2.21-1~bpo12+1","3:4.2.22-1","3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-1","3:4.2.29-1","3:4.2.3-1","3:4.2.30-1","3:4.2.4-1","3:4.2.5-1","3:4.2.5-2","3:4.2.6-1","3:4.2.8-1","3:4.2.9-1","3:4.2~alpha1-1","3:4.2~beta1-1","3:4.2~rc1-1","3:5.0-1","3:5.0.1-1","3:5.0.2-1","3:5.0.3-1","3:5.0.4-1","3:5.0.6-1","3:5.0~alpha1-1","3:5.0~rc1-1","3:5.1-1","3:5.1.1-1","3:5.1.2-1","3:5.1.3-1","3:5.1.4-1","3:5.1.5-1","3:5.1~alpha1-1","3:5.1~beta1-1","3:5.1~rc1-1","3:5.2-1","3:5.2.1-1","3:5.2.13-1","3:5.2.14-1","3:5.2.14-2","3:5.2.15-1","3:5.2.15-2","3:5.2.15-2~bpo13+1","3:5.2.16-1","3:5.2.16-1~bpo13+1","3:5.2.17-1","3:5.2.17-2","3:5.2.17-2~bpo13+1","3:5.2.18-1","3:5.2.18-2","3:5.2.2-1","3:5.2.3-1","3:5.2.4-1","3:5.2.5-1","3:5.2.6-1","3:5.2~alpha1-1","3:5.2~beta1-1","3:5.2~rc1-1","3:6.0-1","3:6.0.1-1","3:6.0.2-1","3:6.0.3-1","3:6.0.4-1","3:6.0.5-1","3:6.0.6-1","3:6.0~alpha1-1","3:6.0~beta1-1","3:6.0~rc1-1","3:6.1-1","3:6.1.1-1","3:6.1.2-1","3:6.1~beta1-1","3:6.1~rc1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.15-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.8"}]}],"versions":["5.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.15"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.13-1.2.mga9"}]}],"bundled":13},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-1.oe2403"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-1.oe2203sp3"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-1.oe2203sp1"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-1.oe2203sp4"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-12.oe2003sp4"}]}],"bundled":10},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.8"},{"introduced":"4.2"},{"fixed":"4.2.15"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","5.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python39-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python3-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-gunicorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.0.0-1.0.1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-gunicorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.0.0-1.0.1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.65.4-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.65.4-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.65.4-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.65.4-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.8-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.8-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.8-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.8-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.32.3-2.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.32.3-2.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el8ui"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150000.1.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150000.1.30.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7","1.6.11-0ubuntu1.3+esm8","1.6.11-0ubuntu1.3+esm9","1.6.11-0ubuntu1.3+esm10","1.6.11-0ubuntu1.3+esm11","1.6.11-0ubuntu1.3+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13","1.8.7-1ubuntu5.14","1.8.7-1ubuntu5.15","1.8.7-1ubuntu5.15+esm1","1.8.7-1ubuntu5.15+esm3","1.8.7-1ubuntu5.15+esm4","1.8.7-1ubuntu5.15+esm5","1.8.7-1ubuntu5.15+esm6","1.8.7-1ubuntu5.15+esm7","1.8.7-1ubuntu5.15+esm8","1.8.7-1ubuntu5.15+esm9","1.8.7-1ubuntu5.15+esm10","1.8.7-1ubuntu5.15+esm11","1.8.7-1ubuntu5.15+esm12","1.8.7-1ubuntu5.15+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.21+esm6"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.24"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.13"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.2"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.21+esm6"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.24"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.13"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.2"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.28-bp155.7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.28-bp155.7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.8-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-1.1"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-4.1"}]}],"bundled":59},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":49},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["Patch","Vendor Advisory","advisory","web"]},{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":["Not Applicable","web"]},{"url":"https://www.djangoproject.com/weblog/2024/aug/06/security-releases/","tags":["Vendor Advisory","advisory","article"]},{"url":"https://security.netapp.com/advisory/ntap-20240905-0007/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41990","tags":["web","advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2024/aug/06/security-releases","tags":["web"]},{"url":"https://github.com/django/django/commit/7b7b909579c8311c140c89b8a9431bf537febf93","tags":["web"]},{"url":"https://github.com/django/django/commit/d0a82e26a74940bf0c78204933c3bdd6a283eb88","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-68.yaml","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240905-0007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-795c-9xpc-xw6g","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-41990","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41990.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-41990","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0039.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33919","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33387","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33507","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/07/09/3","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2024/jul/09/security-releases/","tags":["web"]},{"url":"https://openwall.com/lists/oss-security/2024/08/06/2","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/09/03/3","tags":["web"]},{"url":"https://openwall.com/lists/oss-security/2024/12/04/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/01/14/2","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7205-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41991","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42005","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39614","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2004","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2036","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45231","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6428","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2277035","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2277297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295936","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2298492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302436","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6428.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-5569","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5569","tags":["advisory"]},{"url":"https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd","tags":["article"]},{"url":"https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6840","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-7246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2303104","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7246","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7246","tags":["advisory"]},{"url":"https://github.com/grpc/grpc/issues/36245","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32879","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32879","tags":["advisory"]},{"url":"https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-33663","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-33663","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33663","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-38875","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38875","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-39329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39329","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-39330","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39330","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-39614","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39614","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41989","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41990","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41991","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-42005","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42005","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1335","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/4/html/release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2275280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2275989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278038","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2282114","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHUI-429","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHUI-577","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHUI-617","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1335.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1135","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1135","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w3h3-4rj7-4ph4","tags":["advisory"]},{"url":"https://github.com/benoitc/gunicorn/commit/ac29c9b0a758d21f1e0fb3b3457239e523fa9f1d","tags":["article"]},{"url":"https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4340","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2m57-hf25-phgg","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-26130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26130","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27306","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27306","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-30251","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-30251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30251","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2024/05/02/4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34064","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064","tags":["advisory"]},{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-35195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-35195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195","tags":["advisory"]},{"url":"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242816-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228629","tags":["report"]},{"url":"https://bugzilla.suse.com/1228630","tags":["report"]},{"url":"https://bugzilla.suse.com/1228631","tags":["report"]},{"url":"https://bugzilla.suse.com/1228632","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242817-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1136468","tags":["report"]},{"url":"https://bugzilla.suse.com/1198398","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242861-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-41990","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6946-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-41989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42005","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AVXH6TTRGIUJPHG6XVNN3KNBVNT5ELJK/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-41990","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-07T00:00:00Z","modified":"2025-11-04T16:13:41.723Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:34:04.00829Z"}],"euvd":[{"id":"EUVD-2024-0045","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-07T00:00:00Z","modified":"2025-11-04T16:13:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:28.888576Z"}],"ghsa":[{"id":"GHSA-795c-9xpc-xw6g","title":"Django vulnerable to a denial-of-service attack","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-07T15:30:42Z","modified":"2025-11-04T19:50:41Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-41990","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-07T15:15:56.1Z","modified":"2026-06-17T07:48:35.76Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:10:17.832118Z"}],"osv":[{"id":"ALPINE-CVE-2024-41990","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-07T15:15:56.1Z","modified":"2026-11-03T06:32:08.613350178Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2024-41990","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-07T00:00:00Z","modified":"2026-10-28T02:30:57.087700873Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:41.963899Z"},{"id":"DEBIAN-CVE-2024-41990","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-07T15:15:56.1Z","modified":"2026-11-02T12:02:59.014337435Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"GHSA-795c-9xpc-xw6g","title":"Django vulnerable to a denial-of-service attack","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-07T15:30:42Z","modified":"2025-11-04T21:09:52.07227Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"OESA-2024-2002","title":"python-django security update","description":"Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.(CVE-2024-39329)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)(CVE-2024-39330)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.(CVE-2024-41989)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.(CVE-2024-41990)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.(CVE-2024-41991)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.(CVE-2024-42005)","status":"published","published":"2024-08-16T11:07:28Z","modified":"2026-08-18T01:18:33.585705809Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2003","title":"python-django security update","description":"Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.(CVE-2024-38875)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.(CVE-2024-39329)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)(CVE-2024-39330)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.(CVE-2024-39614)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.(CVE-2024-41989)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.(CVE-2024-41990)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.(CVE-2024-41991)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.(CVE-2024-42005)","status":"published","published":"2024-08-16T11:07:28Z","modified":"2026-08-18T01:18:33.536641806Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2004","title":"python-django security update","description":"Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.(CVE-2024-38875)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.(CVE-2024-39329)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)(CVE-2024-39330)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.(CVE-2024-39614)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.(CVE-2024-41989)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.(CVE-2024-41990)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.(CVE-2024-41991)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.(CVE-2024-42005)","status":"published","published":"2024-08-16T11:07:28Z","modified":"2026-08-18T01:18:33.579594498Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2036","title":"python-django security update","description":"Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.(CVE-2024-38875)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.(CVE-2024-39329)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)(CVE-2024-39330)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.(CVE-2024-39614)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.(CVE-2024-41989)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.(CVE-2024-41990)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.(CVE-2024-41991)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.(CVE-2024-42005)","status":"published","published":"2024-08-23T11:07:30Z","modified":"2026-08-18T01:18:35.93193132Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2280","title":"python-django security update","description":"Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.(CVE-2024-38875)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.(CVE-2024-39329)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)(CVE-2024-39330)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.(CVE-2024-39614)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.(CVE-2024-41989)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.(CVE-2024-41990)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.(CVE-2024-41991)\r\n\r\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.(CVE-2024-42005)\r\n\r\nAn issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.(CVE-2024-45230)\r\n\r\nAn issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).(CVE-2024-45231)","status":"published","published":"2024-10-18T11:07:45Z","modified":"2026-08-18T01:17:35.639475384Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2024:6428","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-30T15:23:01Z","modified":"2026-10-17T10:03:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2025:1335","title":"Red Hat Security Advisory: RHUI 4.11 security, bugfix, and enhancement update","status":"published","published":"2025-02-12T10:04:17Z","modified":"2026-10-17T10:04:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"UBUNTU-CVE-2024-41990","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-06T13:00:00Z","modified":"2026-10-01T14:04:08.00481953Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"BIT-django-2024-41990","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-08T07:17:28.897Z","modified":"2026-09-08T08:46:35.690272769Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"CLSA-2025-1759450296","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.post5+tuxcare.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:48:00.960299682Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1792397200","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 4.2.post18+tuxcare.","status":"published","published":"2026-10-19T08:06:40Z","modified":"2026-10-19T13:30:07.024462443Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"MGASA-2025-0039","title":"Updated python-django packages fix security vulnerabilities","description":"An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before\n5.0.7. urlize and urlizetrunc were subject to a potential denial of\nservice attack via certain inputs with a very large number of brackets.\n(CVE-2024-38875)\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before\n4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate()\nmethod allows remote attackers to enumerate users via a timing attack\ninvolving login requests for users with an unusable password.\n(CVE-2024-39329)\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before\n4.2.14. Derived classes of the django.core.files.storage.Storage base\nclass, when they override generate_filename() without replicating the\nfile-path validations from the parent class, potentially allow directory\ntraversal via certain inputs during a save() call. (CVE-2024-39330)\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before\n4.2.14. get_supported_language_variant() was subject to a potential\ndenial-of-service attack when used with very long strings containing\nspecific characters. (CVE-2024-39614)\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before\n4.2.15. The floatformat template filter is subject to significant memory\nconsumption when given a string representation of a number in scientific\nnotation with a large exponent. (CVE-2024-41989)\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before\n4.2.15. The urlize() and urlizetrunc() template filters are subject to a\npotential denial-of-service attack via very large inputs with a specific\nsequence of characters. (CVE-2024-41990)\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before\n4.2.15. The urlize and urlizetrunc template filters, and the\nAdminURLFieldWidget widget, are subject to a potential denial-of-service\nattack via certain inputs with a very large number of Unicode\ncharacters. (CVE-2024-41991)\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before\n4.2.15. QuerySet.values() and values_list() methods on models with a\nJSONField are subject to SQL injection in column aliases via a crafted\nJSON object key as a passed *arg. (CVE-2024-42005)\nAn issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9,\nand 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters\nare subject to a potential denial-of-service attack via very large\ninputs with a specific sequence of characters. (CVE-2024-45230)\nAn issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The\ndjango.contrib.auth.forms.PasswordResetForm class, when used in a view\nimplementing password reset flows, allows remote attackers to enumerate\nuser e-mail addresses by sending password reset requests and observing\nthe outcome (only when e-mail sending is consistently failing).\n(CVE-2024-45231)\nAn issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10,\nand 4.2 before 4.2.17. The strip_tags() method and striptags template\nfilter are subject to a potential denial-of-service attack via certain\ninputs containing large sequences of nested incomplete HTML entities.\n(CVE-2024-53907)\nAn issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10,\nand 4.2 before 4.2.17. Direct usage of the\ndjango.db.models.fields.json.HasKey lookup, when an Oracle database is\nused, is subject to SQL injection if untrusted data is used as an lhs\nvalue. (CVE-2024-53908)\nAn issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11,\nand 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings\npassed when performing IPv6 validation could lead to a potential\ndenial-of-service attack. The undocumented and private functions\nclean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the\ndjango.forms.GenericIPAddressField form field. (CVE-2024-56374)\n","status":"published","published":"2025-02-05T19:51:21Z","modified":"2026-04-16T04:44:08.897044559Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0272-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n* CVE-2024-42005: Fixed potential SQL injection in QuerySet.values() and values_list() (boo#1228629)\n* CVE-2024-41989: Fixed memory exhaustion in django.utils.numberformat.floatformat() (boo#1228630)\n* CVE-2024-41990: Fixed potential denial-of-service vulnerability in django.utils.html.urlize() (boo#1228631)\n* CVE-2024-41991: Fixed potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget (boo#1228632)\n","status":"published","published":"2024-08-30T13:49:59Z","modified":"2026-02-04T02:35:04.213399Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14247-1","title":"python310-Django-5.0.8-1.1 on GA media","description":"These are all security issues fixed in the python310-Django-5.0.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-08T00:00:00Z","modified":"2026-02-04T04:01:54.989132Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14248-1","title":"python310-Django4-4.2.15-1.1 on GA media","description":"These are all security issues fixed in the python310-Django4-4.2.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-08T00:00:00Z","modified":"2025-05-07T18:16:11.782794Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:10005-1","title":"python312-Django6-6.0-1.1 on GA media","description":"These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-03T00:00:00Z","modified":"2026-03-23T04:54:19.792844Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11235-1","title":"python313-Django4-4.2.30-4.1 on GA media","description":"These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.244458214Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11248-1","title":"python313-Django-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-11T09:15:07.179829219Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2024-68","description":"An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.","status":"published","published":"2024-08-07T15:15:00Z","modified":"2026-06-10T17:01:05.944937202Z","updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"SUSE-SU-2024:2816-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2024-42005: Fixed SQL injection in QuerySet.values() and values_list() (bsc#1228629)\n- CVE-2024-41989: Fixed Memory exhaustion in django.utils.numberformat.floatformat() (bsc#1228630)\n- CVE-2024-41990: Fixed denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228631)\n- CVE-2024-41991: Fixed another denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228632)\n","status":"published","published":"2024-08-07T13:32:24Z","modified":"2026-02-04T03:40:00.012112Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2817-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2024-42005: Fixed SQL injection in QuerySet.values() and values_list() (bsc#1228629)\n- CVE-2024-41989: Fixed Memory exhaustion in django.utils.numberformat.floatformat() (bsc#1228630)\n- CVE-2024-41990: Fixed denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228631)\n- CVE-2024-41991: Fixed another denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228632)\n- CVE-2022-28346: Fixed SQL injection in QuerySet.annotate(),aggregate() and extra() (bsc#1198398)\n- CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)\n","status":"published","published":"2024-08-07T13:32:44Z","modified":"2026-02-04T04:25:08.273999Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2861-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n  \n- Fixed code in CVE-2024-41990 patch\n","status":"published","published":"2024-08-09T07:18:39Z","modified":"2026-02-04T02:44:46.475488Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"USN-6946-1","title":"python-django vulnerabilities","description":"It was discovered that Django incorrectly handled certain strings in\nfloatformat function. An attacker could possibly use this issue to\ncause a memory exhaustion. (CVE-2024-41989)\n\nIt was discovered that Django incorrectly handled very large inputs.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2024-41990)\n\nIt was discovered that Django in AdminURLFieldWidget incorrectly\nhandled certain inputs with a very large number of Unicode characters.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2024-41991)\n\nIt was discovered that Django incorrectly handled certain JSON objects.\nAn attacker could possibly use this issue to cause a potential SQL\ninjection. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04\nLTS. (CVE-2024-42005)\n","status":"published","published":"2024-08-06T16:21:47Z","modified":"2026-04-27T17:32:36.673167538Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}