CVE-2025-26699

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

5.0

EPSS

0.80%

Published

Mar 6, 2025

Modified

Oct 2, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Weaknesses (CWE)

CWE-770

Affected Products (4)

djangoproject · django (up to 4.2.20)vulnerable

djangoproject · django (up to 5.0.13)vulnerable

djangoproject · django (up to 5.1.7)vulnerable

debian · debian_linuxvulnerable

References (5)

https://docs.djangoproject.com/en/dev/releases/security/

Release NotesVendor Advisory

https://groups.google.com/g/django-announce

Vendor Advisory

https://www.djangoproject.com/weblog/2025/mar/06/security-releases/

Release NotesVendor Advisory

http://www.openwall.com/lists/oss-security/2025/03/06/12

Mailing List

https://lists.debian.org/debian-lts-announce/2025/03/msg00012.html

Mailing ListThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs