Skip to content
Fencer Vulns
high 7.5

CVE-2026-1285 json

Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

published 2026-02-03 9 mo ago modified 2026-09-10 59 d ago also BIT-django-2026-1285 , EUVD-2026-5251 , GHSA-4rrr-2h4v-f3j9 , PYSEC-2026-45

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

Patch / fix

  • pypi django 4.2.28, 5.2.11, 6.0.2
  • bitnami django 4.2.28, 5.2.11, 6.0.2
  • djangoproject Django 4.2.28, 5.2.11, 6.0.2
  • python-django Debian 12 3:3.2.25-0+deb12u2
  • python-django Debian 13 3:4.2.28-0+deb13u1
  • python-django Debian 14 3:4.2.28-1

debian advisories DEBIAN-CVE-2026-1285

  • python-django Ubuntu 22.04 LTS 2:3.2.12-2ubuntu1.25
  • python-django Ubuntu 24.04 LTS 3:4.2.11-1ubuntu1.14
  • python-django Ubuntu 25.10 3:5.2.4-1ubuntu2.3
  • python-django Ubuntu 26.04 LTS 3:5.2.9-0ubuntu3
  • python-django Ubuntu Pro 16.04 LTS 1.8.7-1ubuntu5.15+esm11
  • python-django Ubuntu Pro 18.04 LTS 1:1.11.11-1ubuntu1.21+esm14
  • python-django Ubuntu Pro 20.04 LTS 2:2.2.12-1ubuntu0.29+esm7

ubuntu advisories UBUNTU-CVE-2026-1285

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python3.12-django satellite capsule 6.18, satellite 6.18 4.2.30-1.el9pc
  • python3.12-markdown satellite capsule 6.18, satellite 6.18 3.8.2-1.el9pc
  • python3.12-pyOpenSSL satellite capsule 6.18, satellite 6.18 26.0.0-2.el9pc
  • rubygem-activesupport satellite capsule 6.18, satellite 6.18 7.0.8.7-2.el9sat
  • foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.14-1.el8sat
  • foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.14-1.el9sat
  • foreman-cli satellite utils 6.16, satellite 6.16 3.12.0.14-1.el8sat
  • foreman-cli satellite utils 6.16, satellite 6.16 3.12.0.14-1.el9sat

red hat advisories RHSA-2026:14835RHSA-2026:5971RHSA-2026:5970RHSA-2026:3959RHSA-2026:3958

  • python-Django SLE Module for Package Hub 15 SP7, openSUSE Leap 15.6 4.2.11-150600.3.47.1

suse advisories SUSE-SU-2026:0440-1

  • python-Django5 openSUSE Tumbleweed 5.2.16-1.1
  • python-Django4 openSUSE Tumbleweed 4.2.28-1.1
  • python-Django openSUSE Leap 16.0 5.2.4-bp160.5.1
  • python-Django openSUSE Tumbleweed 5.2.11-1.1
  • python-Django6 openSUSE Tumbleweed 6.0.2-1.1

opensuse advisories openSUSE-SU-2026:11270-1openSUSE-SU-2026:10247-1openSUSE-SU-2026:20184-1openSUSE-SU-2026:10160-1openSUSE-SU-2026:10145-1

  • py3-django Alpine 3.24, Alpine 3.23 4.2.28-r0

alpine advisories ALPINE-CVE-2026-1285

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-1285 updated cvss 7.5

Django: Django: Denial of Service via crafted HTML inputs

  • Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Satellite 6 python-django, python2-django, python-django-bash-completion
    affected: workaround, no fix available
  • Red Hat Update Infrastructure 4 for Cloud Providers python-django
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-django 4.2.28-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-django 4.2.28-1.el9ap
    fixed: vendor fix RHSA-2026:3959
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-django 4.2.28-1.el9ap
    fixed: vendor fix RHSA-2026:3958
  • Red Hat Discovery 2 discovery 1770913597
    fixed: vendor fix RHSA-2026:2694
  • Red Hat Satellite 6.16 for RHEL 8 python-django 4.2.28-0.1.el8pc, python3.11-django 4.2.28-0.1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-django 4.2.28-0.1.el9pc, python3.11-django 4.2.28-0.1.el9pc
    fixed: vendor fix RHSA-2026:5971
  • Red Hat Satellite 6.17 for RHEL 9 libcomps 0.1.23-0.3.el9pc, satellite 6.17.7-1.el9sat, foreman 3.14.0.14-1.el9sat, python-brotli 1.2.0-0.1.el9pc, satellite-cli 6.17.7-1.el9sat, foreman-cli 3.14.0.14-1.el9sat, +29 more
    fixed: vendor fix RHSA-2026:5970
show 5 more
  • Red Hat Satellite 6.18 satellite 1773451075
    fixed: vendor fix RHSA-2026:6291
  • Red Hat Satellite 6.18 for RHEL 9 python3.12-django 4.2.30-1.el9pc
    fixed: vendor fix RHSA-2026:14835
  • Red Hat Ansible Automation Platform 2 python-django, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, ansible-automation-platform-25/de-minimal-rhel8, ansible-automation-platform-25/de-minimal-rhel9, ansible-automation-platform-26/de-minimal-rhel9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 tox 4.15.1-2.el8ap, uwsgi 2.0.28-2.el8ap, bindep 2.13.0-2.el8ap, receptor 1.6.3-4.el8ap, yamllint 1.35.1-2.el8ap, molecule 25.12.0-2.el8ap, +301 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 tox 4.15.1-2.el9ap, uwsgi 2.0.28-2.el9ap, bindep 2.13.0-2.el9ap, receptor 1.6.3-4.el9ap, yamllint 1.35.1-2.el9ap, molecule 25.12.0-2.el9ap, +298 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 tox 4.15.1-2.el9ap, uwsgi 2.0.28-2.el9ap, bindep 2.13.0-2.el9ap, receptor 1.6.3-4.el9ap, yamllint 1.35.1-2.el9ap, molecule 25.12.0-2.el9ap, +332 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.3-4.el10ap, receptorctl 1.6.3-4.el10ap, ansible-core 2.16.16-2.el10ap, python-django 4.2.28-2.el10ap, python3-django 4.2.28-2.el10ap Red Hat Discovery 2 discovery 1770913709
    not affected: vulnerable code not present
  • Red Hat OpenStack Platform 16.2 python-django20, python3-django20, python-django20-bash-completion Red Hat OpenStack Platform 17.1 python-django, python3-django Red Hat OpenStack Platform 18.0 python-django
    not affected: vulnerable code not in execute path
  • Red Hat Satellite 6.16 for RHEL 8 libcomps 0.1.23-0.1.el8pc, satellite 6.16.7-1.el8sat, foreman 3.12.0.14-1.el8sat, python-brotli 1.2.0-0.1.el8pc, satellite-cli 6.16.7-1.el8sat, foreman-cli 3.12.0.14-1.el8sat, +25 more Red Hat Satellite 6.16 for RHEL 9 libcomps 0.1.23-0.1.el9pc, satellite 6.16.7-1.el9sat, foreman 3.12.0.14-1.el9sat, python-brotli 1.2.0-0.1.el9pc, satellite-cli 6.16.7-1.el9sat, foreman-cli 3.12.0.14-1.el9sat, +25 more Red Hat Satellite 6.18 for RHEL 9 candlepin 4.6.5-1.el9sat, satellite 6.18.5-1.el9sat, foreman 3.16.0.16-1.el9sat, python3.12-cffi 2.0.0-1.el9pc, satellite-cli 6.18.5-1.el9sat, foreman-cli 3.16.0.16-1.el9sat, +27 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi django
>=6.0a1, <6.0.2
>=5.2a1, <5.2.11
>=4.2a1, <4.2.28
>=4.2, <4.2.28
>=5.2, <5.2.11
>=6.0, <6.0.2
6.0.2
5.2.11
4.2.28
bitnami django
>=4.2.0, <4.2.28
>=5.2.0, <5.2.11
>=6.0.0, <6.0.2
4.2.28
5.2.11
6.0.2

Affected products

  • djangoproject Django

Classification

Weakness
  • CWE-407 Inefficient Algorithmic Complexity
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.