CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVE-2025-32873
Medium (5.3) in djangoproject django. EPSS 14% chance of exploitation in the next 30 days. Fixed in django 4.2.21, 5.1.9, 5.2.1.
An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().
Severity
- EPSS
- 14% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8j24-cjrq-gr2m | PyPI | django | >=4.2 <4.2.21 | 4.2.21 |
| GHSA-8j24-cjrq-gr2m | PyPI | django | >=5.1 <5.1.9 | 5.1.9 |
| GHSA-8j24-cjrq-gr2m | PyPI | django | >=5.2 <5.2.1 | 5.2.1 |
| PYSEC-2025-37 | PyPI | django | >=4.2 <4.2.21 >=5.1 <5.1.9 >=5.2 <5.2.1 | 4.2.21, 5.1.9, 5.2.1 |