Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-27351 Details

Description

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://docs.djangoproject.com/en/5.0/releases/security/ CVERelease NotesVendor Advisory
https://github.com/django/django/commit/072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 CVEPatch
https://github.com/django/django/commit/3394fc6132436eca89e997083bae9985fb7e761e CVEPatch
https://github.com/django/django/commit/3c9a2771cc80821e041b16eb36c1c37af5349d4a CVEPatch
https://groups.google.com/forum/#%21forum/django-announce CVEPermissions Required

see all 20 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-1333Inefficient Regular Expression ComplexityCISA-ADP

Affected Products

ProductVersions
djangoproject django
>= 3.2, < 3.2.25
>= 4.2, < 4.2.11
>= 5.0, < 5.0.3

CPE

  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

13 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-27351
NVD Published Date:
Mar 15, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2024-27351 Details - Not Deferred