CVE-2025-32873 json
Django has a denial-of-service possibility in strip_tags()
published 2025-05-08 18 mo ago modified 2026-09-10 59 d ago also BIT-django-2025-32873 , EUVD-2025-13952 , GHSA-8j24-cjrq-gr2m , PYSEC-2025-37
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.3%
- EPSS 14.3% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().
Patch / fix
- pypi django 4.2.21, 5.1.9, 5.2.1
- bitnami django 4.2.21, 5.1.9, 5.2.5
- djangoproject Django 4.2.21, 5.1.9, 5.2.1
- python-django Debian 12 3:3.2.25-0+deb12u1
- python-django Debian 14, Debian 13 3:4.2.21-1
debian advisories DEBIAN-CVE-2025-32873
- python-django Ubuntu 20.04 LTS 2:2.2.12-1ubuntu0.29
- python-django Ubuntu 22.04 LTS 2:3.2.12-2ubuntu1.18
- python-django Ubuntu 24.04 LTS 3:4.2.11-1ubuntu1.7
- python-django Ubuntu 25.10 3:4.2.18-1ubuntu1.1
- python-django Ubuntu Pro 18.04 LTS 1:1.11.11-1ubuntu1.21+esm11
ubuntu advisories UBUNTU-CVE-2025-32873
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python-Django SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 4.2.11-150600.3.21.1
suse advisories SUSE-SU-2025:01523-1SUSE-SU-2025:1523-1
- python-Django5 openSUSE Tumbleweed 5.2.16-1.1
- python-Django6 openSUSE Tumbleweed 6.0-1.1
- python-Django openSUSE Tumbleweed 5.2.1-1.1
- python-Django4 openSUSE Tumbleweed 4.2.21-1.1
opensuse advisories openSUSE-SU-2026:11270-1openSUSE-SU-2026:10005-1openSUSE-SU-2025:15087-1openSUSE-SU-2025:15082-1
- py3-django Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 4.2.21-r0
alpine advisories ALPINE-CVE-2025-32873
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python-django Arch Linux 5.1.9-1
arch linux advisories AVG-2876
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-32873 updated cvss 5.3
django: Django StripTags Denial of Service
-
Red Hat Ansible Automation Platform 2 python-django, automation-controller, ee-dellemc-openmanage-container, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-24/platform-resource-runner-rhel8, +1 more Red Hat Certification for Red Hat Enterprise Linux 7 python-django Red Hat Discovery 1 discovery/discovery-server-rhel9 Red Hat OpenStack Platform 16.2 python-django20, python3-django20, python-django20-bash-completion Red Hat OpenStack Platform 17.1 python-django, python3-django Red Hat OpenStack Platform 18.0 python-djangoaffected: no fix available “Fix deferred”
+2 more productsfewer
Red Hat Satellite 6 python-django, python2-django, python-django-bash-completion Red Hat Update Infrastructure 4 for Cloud Providers python-django
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
14.31% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django | >=4.2, <4.2.21 >=5.1, <5.1.9 >=5.2, <5.2.1 |
4.2.21 5.1.9 5.2.1 |
| bitnami | django | >=4.2.0, <4.2.21 >=5.1.0, <5.1.9 >=5.2.0, <5.2.5 |
4.2.21 5.1.9 5.2.5 |
Affected products
- djangoproject Django
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
- Technology feeds
References
-
github.com
/django/django/commit/9f3419b519799d69f2aba70b9d25abe2e70d03e0
web
-
djangoproject.com
/weblog/2025/may/07/security-releases/
vendor-advisory, advisory, article
-
docs.djangoproject.com
/en/dev/releases/security/
release-notes, article, web
-
groups.google.com
/g/django-announce
web, mailing-list, discussion
-
openwall.com
/lists/oss-security/2025/05/07/1
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-32873
advisory, web
-
docs.djangoproject.com
/en/dev/releases/security
web
-
github.com
/django/django
package
-
github.com
/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-37.yaml
web
-
djangoproject.com
/weblog/2025/may/07/security-releases
web
-
github.com
/advisories/GHSA-8j24-cjrq-gr2m
advisory
Sources
- CVE List CVE-2025-32873
- GitHub Advisory GHSA-8j24-cjrq-gr2m
- NVD CVE-2025-32873
- OSV BIT-django-2025-32873
- OSV PYSEC-2025-37
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.