cve.bz

CVE-2023-36053

7.5 highEPSS 3.0%

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE
CWE-1333
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-jh3w-4vvf-mjgrPyPIdjango>=3.2a1 <3.2.203.2.20
GHSA-jh3w-4vvf-mjgrPyPIdjango>=4.0a1 <4.1.104.1.10
GHSA-jh3w-4vvf-mjgrPyPIdjango>=4.2a1 <4.2.34.2.3
PYSEC-2023-100PyPIdjango>=4.2 <4.2.3
>=4.0 <4.1.10
>=3.2 <3.2.20		4.2.3, 4.1.10, 3.2.20

References

Check your stackJSON