CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2024-56374
High (7.5). EPSS 1.3% chance of exploitation in the next 30 days. Fixed in django 4.2.18, 5.0.11, 5.1.5.
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qcgg-j2x8-h9g8 | PyPI | django | >=5.1 <5.1.5 | 5.1.5 |
| GHSA-qcgg-j2x8-h9g8 | PyPI | django | >=5.0 <5.0.11 | 5.0.11 |
| GHSA-qcgg-j2x8-h9g8 | PyPI | django | >=4.2 <4.2.18 | 4.2.18 |
| GHSA-qcgg-j2x8-h9g8 | PyPI | django | >=5.1 <5.1.5 | 5.1.5 |
| GHSA-qcgg-j2x8-h9g8 | PyPI | django | >=5.0 <5.0.11 | 5.0.11 |
| GHSA-qcgg-j2x8-h9g8 | PyPI | django | >=4.2 <4.2.18 | 4.2.18 |
| PYSEC-2025-1 | PyPI | django | >=5.1 <5.1.5 >=5.0 <5.0.11 >=4.2 <4.2.18 | 5.1.5, 5.0.11, 4.2.18 |