Skip to main content

Django CVE-2026-15337

| EUVDEUVD-2026-52748 MEDIUM
Memory Allocation with Excessive Size Value (CWE-789)
2026-08-04 GHSA-2f9m-qhxg-w5v5
Python Information Disclosure Django Djangoproject
6.9
CVSS 4.0 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify site with set_language view enabled
  2. Delivery
    Send POST requests with many distinct oversized language codes
  3. Exploit
    Populate in-memory cache with large string keys
  4. Execution
    Consume process memory incrementally
  5. Impact
    Degrade worker availability

Vulnerability Assessment

Weakness
CWE
CWE-789
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
Exploitation Conditions

Exploitation requires that django.views.i18n.set_language is explicitly included in the Django project's URL configuration - this view is NOT active by default, so the vast majority of Django deployments are not exposed via this attack path. If the view is exposed, no authentication is required assuming it is publicly accessible (authentication requirements not confirmed from CVSS data, which is absent). The attack is further bounded by two hard limits: Django's DATA_UPLOAD_MAX_MEMORY_SIZE setting caps the POST body size per request, and the in-memory cache has a configured maximum number of entries. These bounds prevent unbounded memory exhaustion but do not eliminate gradual degradation under sustained attack. Exploitation is limited to availability impact only - there is no path to code execution or data disclosure through this vulnerability.
Impact

No CVSS vector or EPSS score is provided in the available data; all metric assessments below are independently inferred. The Django security team rates this 'low' severity - the lowest tier in their policy - primarily because natural system bounds limit exploitation: per-request POST body size is capped by DATA_UPLOAD_MAX_MEMORY_SIZE, and the cache enforces a maximum entry count, meaning memory growth is bounded rather than unlimited. There is no KEV listing and no known POC. Crucially, the set_language view is not active by default - deployments that never include it in URL configuration are entirely unexposed. Real-world risk is therefore low and conditional on an explicit deployment choice. No conflict between data sources was detected; the Django advisory, oss-security post, and patch code are consistent.
Exploit ScenarioDerived

An attacker discovers a Django application with the set_language view explicitly wired into its URL configuration. They script repeated POST requests to the language-selection endpoint, each containing a distinct language code string of several hundred characters, causing the in-memory translation cache to accumulate a growing number of large keys. Sustained over time, this progressively degrades available process memory, potentially slowing or crashing the application worker.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 04, 2026

Memory exhaustion in Django's check_for_language() function allows denial-of-service via the set_language view when it is explicitly enabled in URL configuration. Attackers can submit many distinct, very long language codes via POST requests, causing each code to be cached as an in-memory key and progressively consuming process memory. Django rates this severity 'low' because built-in guards - DATA_UPLOAD_MAX_MEMORY_SIZE and the cache's maximum entry count - bound the total exploitable memory; no public exploit identified at time of analysis.

RemediationAI

Upgrade to Django 5.2.17 or Django 6.0.8, both released August 4, 2026, available at https://www.djangoproject.com/download/. These releases enforce a 500-character maximum on language codes before any cache interaction, fully mitigating the vulnerability. As an immediate compensating control for environments that cannot upgrade promptly, remove django.views.i18n.set_language from the URL configuration - since this view is not active by default, its removal has no impact on sites that do not use language-switching functionality. If the view must remain active, deploying rate-limiting at the reverse proxy or WAF layer on POST requests to the set_language endpoint reduces the volume of cache-polluting requests; note that rate-limiting by IP may not prevent distributed sources. Patches are also applied to the main and 6.1 branches per the advisory.

Affected VersionsENISA

Django 5.2 <5.2.17
Django 6.0 <6.0.8

Affected Packages

euvd django fix: 5.2.17, 6.0.8

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is in django.utils.translation.check_for_language(), which stores per-language-code results in an in-memory cache keyed by the raw language code string. Without a length check, arbitrarily long strings became cache keys, and submitting many distinct oversized strings caused unconstrained key accumulation in process memory. The attack surface is django.views.i18n.set_language, which accepts a POST language parameter and forwards it directly to check_for_language(). No CWE or CPE identifiers were supplied by the vendor or NVD, but the root cause is an input validation gap (missing length constraint) at the boundary between user-supplied POST data and an in-memory caching operation - analogous to CWE-400 (Uncontrolled Resource Consumption). The fix enforces a 500-character maximum on language codes before the cached lookup.

Know when Django gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
vuln.today AI 3.7 LOW

Non-default view must be explicitly enabled (AC:H); no authentication or interaction needed if exposed; only bounded availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.3 MEDIUM

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch available
Aug 04, 2026 - 17:16 EUVD
CVE Published
Aug 04, 2026 - 16:06 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

Django applications with the set_language view explicitly enabled face a potential denial-of-service vulnerability that can exhaust application process memory, risking service degradation or outages. While no public exploit has been identified at time of analysis, the criticality rating warrants prompt mitigation for any organizations with this view actively configured.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable set_language view if not operationally required; implement request rate limiting on language-selection endpoints; reduce DATA_UPLOAD_MAX_MEMORY_SIZE and cache entry-count limits to constrain exploitable memory; deploy web application firewall rules to block requests with abnormally long language code parameters; establish monitoring and alerting on memory consumption anomalies.

Threat Intelligence Overview

EPSS Score
0.5%
Top 59% exploitable
Prevalence
High
dominant Python web framework across enterprise, startup, and government deployments
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

35
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +34
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Django

View all
CVE-2021-23336 MEDIUM POC
5.9 Feb 15

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9
CVE-2017-12794 MEDIUM POC
6.1 Sep 07

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for
CVE-2022-34265 CRITICAL POC
9.8 Jul 04

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. Rated critical severity (CVSS 9.8), this vulne
CVE-2021-35042 CRITICAL POC
9.8 Jul 02

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input

CVE-2019-19844 CRITICAL POC
9.8 Dec 18

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. Rated critical severity (CVSS 9.8
CVE-2026-61594 CRITICAL POC
9.1 Sep 16

An authentication/authorization bypass in the djust Python live-view framework (versions prior to 1.0.7) lets unauthenti
CVE-2026-61599 HIGH POC
8.8 Sep 16

Unauthenticated arbitrary Python module import in djust before 1.0.7 lets any client that can reach the WebSocket or SSE
CVE-2020-9402 HIGH POC
8.8 Mar 05

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a

CVE-2016-6186 MEDIUM POC
6.1 Aug 05

Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/j
CVE-2026-93456 HIGH POC
8.4 Sep 18

Forged content modification in django-page-cms through 2.0.13 lets unauthenticated remote attackers exploit five CSRF-ex
CVE-2026-61593 HIGH POC
8.1 Sep 16

Cross-site request forgery in djust's Server-Sent-Events transport affects all versions prior to 1.0.7 and allows a cros
CVE-2026-61590 HIGH POC
7.4 Sep 16

Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through dju

Same weakness CWE-789 – Memory Allocation with Excessive Size Value

View all
CVE-2026-65315 HIGH POC
8.7
CVE-2026-59204 HIGH POC
8.7
CVE-2026-91752 HIGH POC
8.7
CVE-2018-25368 HIGH POC
8.7
CVE-2021-47973 HIGH POC
8.7
CVE-2021-47972 HIGH POC
8.7
CVE-2021-47971 HIGH POC
8.7
CVE-2021-47970 HIGH POC
8.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP6 Affected

References

Advisories & patches
PATCH https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e PATCH https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b PATCH https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa PATCH https://github.com/django/django/commit/224dbc832586ad5cfb0237c2ff30d14baeaddc6f PATCH https://github.com/django/django/commit/27137e655e442e81095f1f8f77ff3870d9fdf169 PATCH https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6 PATCH https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d PATCH https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a PATCH https://github.com/django/django/commit/5b3523d29be25948e1dd90b3863a002f00fc865f PATCH https://github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6 PATCH https://github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06 PATCH https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349 PATCH https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080 PATCH https://github.com/django/django/commit/c72a5dbb64d0777f3f471f1be94e8b2ca91e0959 PATCH https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0d PATCH https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520 ADVISORY https://docs.djangoproject.com/en/dev/ref/contrib/gis/gdal/#raster-security ADVISORY https://docs.djangoproject.com/en/dev/releases/security/ ADVISORY https://groups.google.com/g/django-announce ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-15337 ADVISORY https://seclists.org/oss-sec/2026/q3/406 ADVISORY https://vuldb.com/vuln/385873 ADVISORY https://www.djangoproject.com/download/5.2.17/checksum/ ADVISORY https://www.djangoproject.com/weblog/2026/aug/04/security-releases/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3503/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy