CVE-2024-56374
📋 TL;DR
This vulnerability in Django allows attackers to cause denial-of-service by sending specially crafted IPv6 addresses to vulnerable validation functions. It affects Django applications using the GenericIPAddressField form field or calling the undocumented clean_ipv6_address/is_valid_ipv6_address functions directly.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion from processing maliciously long IPv6 strings, potentially affecting all users of the application.
Likely Case
Degraded performance or temporary service disruption for specific endpoints that process user-supplied IPv6 addresses through vulnerable form fields.
If Mitigated
Minimal impact with proper input validation and rate limiting in place before requests reach Django's validation layer.
🎯 Exploit Status
Exploitation requires sending malicious IPv6 strings to vulnerable endpoints, which is straightforward but requires knowledge of affected form fields/functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 5.1.5, Django 5.0.11, Django 4.2.18
Vendor Advisory: https://www.djangoproject.com/weblog/2025/jan/14/security-releases/
Restart Required: Yes
Instructions:
1. Backup your Django project. 2. Update Django using pip: 'pip install --upgrade Django==5.1.5' (or appropriate version). 3. Restart your Django application server. 4. Test affected functionality.
🔧 Temporary Workarounds
Input validation wrapper
allAdd custom validation to limit IPv6 string length before Django processing
# In your form/view code, add length check before processing IPv6
# Example: if len(ipv6_input) > 100: raise ValidationError('Invalid input')
Rate limiting
allImplement request rate limiting on endpoints accepting IPv6 addresses
# Use Django Ratelimit or similar middleware
# Example: @ratelimit(key='ip', rate='10/m')
🧯 If You Can't Patch
- Disable or replace forms using GenericIPAddressField with custom validated fields
- Implement web application firewall (WAF) rules to block excessively long IPv6 strings
🔍 How to Verify
Check if Vulnerable:
Check Django version: 'python -m django --version'. If version is 5.1.0-5.1.4, 5.0.0-5.0.10, or 4.2.0-4.2.17, you are vulnerable.Check Version:
python -m django --versionVerify Fix Applied:
After patching, verify version shows 5.1.5, 5.0.11, or 4.2.18. Test form submission with long IPv6 strings to ensure proper validation.📡 Detection & Monitoring
Log Indicators:
- Multiple failed validation attempts with unusually long strings
- Increased error rates from GenericIPAddressField forms
- Unusual performance degradation on form processing endpoints
Network Indicators:
- High volume of requests to endpoints accepting IPv6 addresses
- Requests containing abnormally long IPv6 strings
SIEM Query:
source="django" AND (message="ValidationError" OR message="clean_ipv6_address") AND (message:"IPv6" OR message:"GenericIPAddressField")