Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-django | Jul 30, 2024 | Oct 13, 2009 |
| Freebsd | — | Upgrade py31-django-develUpgrade py23-django-develUpgrade py24-djangoUpgrade py25-django-develUpgrade py30-django-develUpgrade py30-djangoUpgrade py23-djangoUpgrade py26-django-develUpgrade py25-djangoUpgrade py24-django-develUpgrade py31-djangoUpgrade py26-django | Dec 10, 2025 | Oct 16, 2009 |
| Ubuntu | — | Upgrade python-django | Nov 19, 2024 | Oct 13, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub