high 7.5

CVE-2024-41989 json

Django memory consumption vulnerability

published 2024-08-07 2 y ago modified 2026-09-08 2 mo ago also BIT-django-2024-41989 , EUVD-2024-0044 , GHSA-jh75-99hh-qvx9 , PYSEC-2024-67

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits: 0; none known

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

Patch / fix

fixed in 3 distros 6 links 3

pypi django 4.2.15, 5.0.8
bitnami django 4.2.15, 5.0.8
djangoproject django 4.2.15, 5.0.8

debian ubuntu red hat suse opensuse alpine

python-django Debian 12 3:3.2.25-0+deb12u1
python-django Debian 14, Debian 13 3:4.2.15-1

debian advisories DEBIAN-CVE-2024-41989

python-django Ubuntu 20.04 LTS 2:2.2.12-1ubuntu0.24
python-django Ubuntu 22.04 LTS 2:3.2.12-2ubuntu1.13
python-django Ubuntu 24.04 LTS 3:4.2.11-1ubuntu1.2
python-django Ubuntu Pro 18.04 LTS 1:1.11.11-1ubuntu1.21+esm6

ubuntu advisories UBUNTU-CVE-2024-41989

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python-django rhui 4 4.2.15-1.el8ui
python-grpcio rhui 4 1.65.4-1.el8ui
python-jinja2 rhui 4 3.1.4-1.el8ui
python-aiohttp rhui 4 3.9.4-1.el8ui
python-gunicorn rhui 4 22.0.0-1.0.1.el8ui
python-requests rhui 4 2.32.3-2.el8ui
python-sqlparse rhui 4 0.5.0-1.el8ui
python3.11-django rhui 4 4.2.15-1.el8ui

red hat advisories RHSA-2025:1335 RHSA-2024:8534 RHSA-2024:6428

python-Django openSUSE Leap 15.5 2.0.7-150000.1.27.1
python-Django SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 4.2.11-150600.3.6.1

suse advisories SUSE-SU-2024:2817-1 SUSE-SU-2024:2816-1

python-Django5 openSUSE Tumbleweed 5.2.16-1.1
python-Django openSUSE Tumbleweed 5.2.16-1.1
python-Django4 openSUSE Tumbleweed 4.2.30-4.1
python-Django6 openSUSE Tumbleweed 6.0-1.1
python-Django Package Hub 15 SP5, openSUSE Leap 15.5 2.2.28-bp155.7.15.1
python-Django openSUSE Tumbleweed 5.0.8-1.1
python-Django4 openSUSE Tumbleweed 4.2.15-1.1

opensuse advisories openSUSE-SU-2026:11270-1 openSUSE-SU-2026:11248-1 openSUSE-SU-2026:11235-1 openSUSE-SU-2026:10005-1 openSUSE-SU-2024:0272-1 openSUSE-SU-2024:14247-1

py3-django Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 4.2.16-r0

alpine advisories ALPINE-CVE-2024-41989

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

github.com/django/django@27900fe commit
github.com/django/django@fc76660 commit
docs.djangoproject.com/en/dev/releases/security/ advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-41989 updated 2026-11-05 cvss 7.5

python-django: Memory exhaustion in django.utils.numberformat.floatformat()

Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/lightspeed-rhel8
affected: workaround, no fix available
Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification
affected: workaround, no fix available “Fix deferred”
Red Hat Satellite 6 python-django, python2-django, python-django-bash-completion
affected: workaround, no fix available
Red Hat Discovery 1 for RHEL 9 discovery/discovery-ui-rhel9 1.12.0-1, discovery/discovery-server-rhel9 1.12.0-1
fixed: vendor fix RHSA-2025:1249
Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-django 4.2.15-1.el8ap, python3x-django 4.2.15-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-django 4.2.15-1.el9ap, python3-django 4.2.15-1.el9ap
fixed: vendor fix RHSA-2024:6428
Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower 4.6.2-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower 4.6.2-1.el9ap
fixed: vendor fix RHSA-2024:8534
Red Hat RHUI 4 for RHEL 8 python-django 4.2.15-1.el8ui, python3.11-django 4.2.15-1.el8ui
fixed: vendor fix RHSA-2025:1335
Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/ee-dellemc-openmanage-rhel8, ansible-automation-platform-24/platform-resource-runner-rhel8 Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-zipp 3.19.2-1.el8ap, python39-grpcio 1.58.3-1.el8ap, python3x-grpcio 1.58.3-1.el8ap, python39-gunicorn 22.0.0-2.el8ap, python39-jmespath 0.10.0-5.el8ap, python3x-gunicorn 22.0.0-2.el8ap, +10 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-zipp 3.19.2-1.el9ap, python3-zipp 3.19.2-1.el9ap, python-grpcio 1.58.3-1.el9ap, python3-grpcio 1.58.3-1.el9ap, python-gunicorn 22.0.0-2.el9ap, python-jmespath 0.10.0-5.el9ap, +11 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.4.9-2.el8ap, receptorctl 1.4.9-2.el8ap, automation-hub 4.10.1-1.el8ap, automation-gateway 2.5.3-1.el8ap, automation-controller 4.6.2-1.el8ap, python3.11-galaxy-ng 4.10.1-1.el8ap, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.4.9-2.el9ap, receptorctl 1.4.9-2.el9ap, automation-hub 4.10.1-1.el9ap, automation-gateway 2.5.3-1.el9ap, automation-controller 4.6.2-1.el9ap, python3.11-galaxy-ng 4.10.1-1.el9ap, +20 more Red Hat RHUI 4 for RHEL 8 libcomps 0.1.21-1.el8ui, python-jq 1.6.0-4.el8ui, python-xlrd 2.0.1-9.el8ui, python-xlwt 1.3.0-7.el8ui, python-yarl 1.8.2-5.el8ui, python-zipp 3.4.0-8.el8ui, +196 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-08-08)

Exploit prediction

1.20% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	django	>=5.0, <5.0.8 >=4.2, <4.2.15	5.0.8 4.2.15
bitnami	django	>=4.2.0, <4.2.15 >=5.0.0, <5.0.8	4.2.15 5.0.8

Affected products

djangoproject django

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

Technology feeds

Django rss critical rss

References

docs.djangoproject.com /en/dev/releases/security/
patch, vendor-advisory, advisory, web
github.com /django/django/commit/27900fe56f3d3cabb4aeb6ccb82f92bab29073a8
web
github.com /django/django/commit/fc76660f589ac07e45e9cd34ccb8087aeb11904b
web
djangoproject.com /weblog/2024/aug/06/security-releases/
vendor-advisory, advisory, article
groups.google.com /forum/#%21forum/django-announce
web, not-applicable
security.netapp.com /advisory/ntap-20240905-0007/
web
nvd.nist.gov /vuln/detail/CVE-2024-41989
advisory, web
docs.djangoproject.com /en/dev/releases/security
web
github.com /django/django
package
github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-67.yaml
web
security.netapp.com /advisory/ntap-20240905-0007
web
djangoproject.com /weblog/2024/aug/06/security-releases
web
github.com /advisories/GHSA-jh75-99hh-qvx9
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary