high 7.5

CVE-2024-45230 in the critical feed json

Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters

published 2024-10-08 2 y ago modified 2026-09-08 2 mo ago also BIT-django-2024-45230 , EUVD-2024-0037 , GHSA-5hgc-2vfp-mqvc , PYSEC-2024-102

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 25.8%; EPSS 25.8% chance of exploitation in 30 days, percentile 97%
public exploits: 0; none known

An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

Patch / fix

fixed in 3 distros 6 links 3

pypi django 4.2.16, 5.0.9, 5.1.1
bitnami django 4.2.16, 5.0.9, 5.2.5
djangoproject django 4.2.16, 5.0.9, 5.1.1

debian ubuntu red hat suse opensuse alpine

python-django Debian 14, Debian 13 3:4.2.16-1

debian advisories DEBIAN-CVE-2024-45230

python-django Ubuntu 20.04 LTS 2:2.2.12-1ubuntu0.25
python-django Ubuntu 22.04 LTS 2:3.2.12-2ubuntu1.14
python-django Ubuntu 24.04 LTS 3:4.2.11-1ubuntu1.3
python-django Ubuntu Pro 18.04 LTS 1:1.11.11-1ubuntu1.21+esm7

ubuntu advisories UBUNTU-CVE-2024-45230

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.4.9-2.el8ap
receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.4.9-2.el9ap
receptorctl ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.4.9-2.el8ap
receptorctl ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.4.9-2.el9ap
automation-gateway-server ansible automation platform 2.5 2.5.3-1.el8ap
automation-gateway-server ansible automation platform 2.5 2.5.3-1.el9ap
automation-controller-venv-tower ansible automation platform 2.5 4.6.2-1.el8ap
automation-controller-venv-tower ansible automation platform 2.5 4.6.2-1.el9ap

red hat advisories RHSA-2024:8534

python-Django openSUSE Leap 15.5 2.0.7-150000.1.36.1
python-Django SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 4.2.11-150600.3.9.1
python-Django openSUSE Leap 15.5 2.0.7-150000.1.33.1

suse advisories SUSE-SU-2024:3187-1 SUSE-SU-2024:3161-1 SUSE-SU-2024:3139-1

python-Django5 openSUSE Tumbleweed 5.2.16-1.1
python-Django openSUSE Tumbleweed 5.2.16-1.1
python-Django4 openSUSE Tumbleweed 4.2.30-4.1
python-Django6 openSUSE Tumbleweed 6.0-1.1
python-Django Package Hub 15 SP5, openSUSE Leap 15.5 2.2.28-bp155.7.18.1
python-Django openSUSE Tumbleweed 5.1.1-1.1
python-Django4 openSUSE Tumbleweed 4.2.16-1.1

opensuse advisories openSUSE-SU-2026:11270-1 openSUSE-SU-2026:11248-1 openSUSE-SU-2026:11235-1 openSUSE-SU-2026:10005-1 openSUSE-SU-2024:0282-1 openSUSE-SU-2024:14318-1

py3-django Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 4.2.16-r0

alpine advisories ALPINE-CVE-2024-45230

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-45230 updated 2026-11-05 cvss 5.9

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize()

Red Hat Ansible Automation Platform 1.2 ansible-tower
affected: workaround, no fix planned “Will not fix”
Red Hat Ansible Automation Platform 2 python-django, ansible-automation-platform-25/lightspeed-rhel8
affected: workaround, no fix available
Red Hat Certification for Red Hat Enterprise Linux 7 python-django
affected: workaround, no fix available “Fix deferred”
Red Hat Discovery 1 discovery-server-container
affected: workaround, no fix available
Red Hat OpenStack Platform 16.2 python-django20, python3-django20, python-django20-bash-completion
affected: workaround, no fix planned “Will not fix”
Red Hat OpenStack Platform 17.1 python-django, python3-django
affected: workaround, no fix available “Fix deferred”
Red Hat Storage 3 python-django, python2-django, python-django-bash-completion
affected: workaround, no fix planned “Out of support scope”
Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower 4.6.2-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower 4.6.2-1.el9ap
fixed: vendor fix RHSA-2024:8534

show 2 more

Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/ee-dellemc-openmanage-rhel8, ansible-automation-platform-24/platform-resource-runner-rhel8 Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.4.9-2.el8ap, receptorctl 1.4.9-2.el8ap, automation-hub 4.10.1-1.el8ap, automation-gateway 2.5.3-1.el8ap, automation-controller 4.6.2-1.el8ap, python3.11-galaxy-ng 4.10.1-1.el8ap, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.4.9-2.el9ap, receptorctl 1.4.9-2.el9ap, automation-hub 4.10.1-1.el9ap, automation-gateway 2.5.3-1.el9ap, automation-controller 4.6.2-1.el9ap, python3.11-galaxy-ng 4.10.1-1.el9ap, +20 more Red Hat Satellite 6 python-django, python2-django, python-django-bash-completion
not affected: vulnerable code not present
Red Hat Update Infrastructure 4 for Cloud Providers python-django
not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-10-30)

Exploit prediction

25.77% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	django	>=5.1, <5.1.1 >=5.0, <5.0.9 >=4.2, <4.2.16	5.1.1 5.0.9 4.2.16
bitnami	django	>=4.2.0, <4.2.16 >=5.0.0, <5.0.9 >=5.1.0, <5.2.5	4.2.16 5.0.9 5.2.5

Affected products

djangoproject django

Classification

Weakness

CWE-120 Buffer Copy without Checking Size of Input
CWE-400 Uncontrolled Resource Consumption

Technology feeds

Django rss critical rss

References

github.com /django/django/commit/022ab0a75c76ab2ea31dfcc5f2cf5501e378d397
web
github.com /django/django/commit/813de2672bd7361e9a453ab62cd6e52f96b6525b
web
github.com /django/django/commit/d147a8ebbdf28c17cafbbe2884f0bc57e2bf82e2
web
docs.djangoproject.com /en/dev/releases/security/
vendor-advisory, advisory, web
djangoproject.com /weblog/2024/sep/03/security-releases/
vendor-advisory, advisory, article
groups.google.com /forum/#%21forum/django-announce
web, permissions-required
nvd.nist.gov /vuln/detail/CVE-2024-45230
advisory, web
docs.djangoproject.com /en/dev/releases/security
web
github.com /django/django
package
github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-102.yaml
web
djangoproject.com /weblog/2024/sep/03/security-releases
web
github.com /advisories/GHSA-5hgc-2vfp-mqvc
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary