CVE-2024-39614

HIGH

Django <5.0.7, <4.2.14 - DoS

Title source: llm

Description

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

Exploits (1)

nomisec WORKING POC

by Abdurahmon3236 · poc

https://github.com/Abdurahmon3236/-CVE-2024-39614

View Code ZIP pw:eip

References (4)

[Vendor Advisory] https://docs.djangoproject.com/en/dev/releases/security/

[Permissions Required] https://groups.google.com/forum/#%21forum/django-announce

[Vendor Advisory] https://www.djangoproject.com/weblog/2024/jul/09/security-releases/

[Vendor Advisory] https://security.netapp.com/advisory/ntap-20240808-0005/

Scores

CVSS v3 7.5

EPSS 0.0684

EPSS Percentile 91.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-130

Status published

Products (2)

djangoproject/django 4.2 - 4.2.14

pypi/Django 5.0 - 5.0.7PyPI

Published Jul 10, 2024

Tracked Since Feb 18, 2026