EUVD-2026-52748
GHSA-2f9m-qhxg-w5v5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default view must be explicitly enabled (AC:H); no authentication or interaction needed if exposed; only bounded availability impact.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Memory exhaustion in Django's check_for_language() function allows denial-of-service via the set_language view when it is explicitly enabled in URL configuration. Attackers can submit many distinct, very long language codes via POST requests, causing each code to be cached as an in-memory key and progressively consuming process memory. Django rates this severity 'low' because built-in guards - DATA_UPLOAD_MAX_MEMORY_SIZE and the cache's maximum entry count - bound the total exploitable memory; no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability is in django.utils.translation.check_for_language(), which stores per-language-code results in an in-memory cache keyed by the raw language code string. Without a length check, arbitrarily long strings became cache keys, and submitting many distinct oversized strings caused unconstrained key accumulation in process memory. The attack surface is django.views.i18n.set_language, which accepts a POST language parameter and forwards it directly to check_for_language(). No CWE or CPE identifiers were supplied by the vendor or NVD, but the root cause is an input validation gap (missing length constraint) at the boundary between user-supplied POST data and an in-memory caching operation - analogous to CWE-400 (Uncontrolled Resource Consumption). The fix enforces a 500-character maximum on language codes before the cached lookup.
RemediationAI
Upgrade to Django 5.2.17 or Django 6.0.8, both released August 4, 2026, available at https://www.djangoproject.com/download/. These releases enforce a 500-character maximum on language codes before any cache interaction, fully mitigating the vulnerability. As an immediate compensating control for environments that cannot upgrade promptly, remove django.views.i18n.set_language from the URL configuration - since this view is not active by default, its removal has no impact on sites that do not use language-switching functionality. If the view must remain active, deploying rate-limiting at the reverse proxy or WAF layer on POST requests to the set_language endpoint reduces the volume of cache-polluting requests; note that rate-limiting by IP may not prevent distributed sources. Patches are also applied to the main and 6.1 branches per the advisory.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today