CVE-2025-26699
📋 TL;DR
A denial-of-service vulnerability exists in Django's text wrapping functions when processing extremely long strings. Attackers can cause excessive CPU consumption by passing specially crafted input to django.utils.text.wrap() or the wordwrap template filter. This affects Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, potentially affecting multiple Django applications on the same server.
Likely Case
Degraded performance or temporary service disruption for affected endpoints until the malicious request times out or is terminated.
If Mitigated
Minimal impact with proper input validation, rate limiting, and monitoring in place.
🎯 Exploit Status
Exploitation requires sending a very long string to an endpoint that uses the vulnerable functions. No authentication needed if the endpoint is public.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 5.1.7, Django 5.0.13, Django 4.2.20
Vendor Advisory: https://www.djangoproject.com/weblog/2025/mar/06/security-releases/
Restart Required: Yes
Instructions:
1. Backup your Django project and database. 2. Update Django using pip: 'pip install Django==5.1.7' (or appropriate version). 3. Restart your Django application server (e.g., Gunicorn, uWSGI). 4. Test application functionality.
🔧 Temporary Workarounds
Input length validation
allAdd validation to limit string length before passing to wrap() or wordwrap filter.
Disable vulnerable functions
allReplace usage of django.utils.text.wrap() and wordwrap template filter with alternative implementations.
🧯 If You Can't Patch
- Implement strict input validation to reject strings longer than a reasonable threshold (e.g., 10,000 characters).
- Deploy rate limiting and web application firewall rules to block requests with unusually long parameters.
🔍 How to Verify
Check if Vulnerable:
Check Django version: 'python -m django --version'. If version is 5.1.0-5.1.6, 5.0.0-5.0.12, or 4.2.0-4.2.19, you are vulnerable.Check Version:
python -m django --versionVerify Fix Applied:
After updating, verify version shows 5.1.7, 5.0.13, or 4.2.20. Test endpoints that use text wrapping with long strings to ensure they handle input properly.📡 Detection & Monitoring
Log Indicators:
- Requests with extremely long parameter values
- High CPU usage spikes on Django processes
- Application timeouts or 500 errors
Network Indicators:
- HTTP requests with parameters exceeding normal length thresholds
SIEM Query:
source="django" AND (message="Timeout" OR message="CPU" OR param_length>10000)