CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2024-41989
High (7.5) in djangoproject django. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in django 4.2.15, 5.0.8.
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jh75-99hh-qvx9 | PyPI | django | >=5.0 <5.0.8 | 5.0.8 |
| GHSA-jh75-99hh-qvx9 | PyPI | django | >=4.2 <4.2.15 | 4.2.15 |
| PYSEC-2024-67 | PyPI | django | >=5.0 <5.0.8 >=4.2 <4.2.15 | 5.0.8, 4.2.15 |