{"id":"CVE-2023-36053","published":"2023-07-03T00:00:00Z","modified":"2025-11-04T17:12:33Z","title":"In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.02978,"percentile":0.87254,"provenance":"source"},"cwes":[{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity"}],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":[]},{"url":"https://docs.djangoproject.com/en/4.2/releases/security/","tags":[]},{"url":"https://www.djangoproject.com/weblog/2023/jul/03/security-releases/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00022.html","tags":["mailing-list"]},{"url":"https://www.debian.org/security/2023/dsa-5465","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/","tags":[]}],"priority":{"score":22.7,"factors":[{"name":"EPSS percentile","points":17.45},{"name":"CVSS severity","points":5.25}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=3.2a1, <3.2.20",">=4.0a1, <4.1.10",">=4.2a1, <4.2.3",">=4.2, <4.2.3",">=4.0, <4.1.10",">=3.2, <3.2.20"],"patched":["3.2.20","4.1.10","4.2.3"],"from":["GHSA-jh3w-4vvf-mjgr","PYSEC-2023-100"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0065","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-djangoproject-django-cve-2014-0474","parents":[{"from":"CVE-2021-32052","to":"CVE-2023-36053","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/core/validators.py"],"commits":["https://github.com/django/django/commit/e1e81aa1c4427411e3c68facdd761229ffea6f6f","https://github.com/django/django/commit/454f2fb93437f98917283336201b4048293f7582","https://github.com/django/django/commit/ad0410ec4f458aa39803e5f6b9a3736527062dcd"],"basis":"shared function","functions":["__init__"]}]}],"children":[{"from":"CVE-2023-36053","to":"CVE-2024-56374","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/forms/fields.py"],"commits":["https://github.com/django/django/commit/454f2fb93437f98917283336201b4048293f7582","https://github.com/django/django/commit/ad0410ec4f458aa39803e5f6b9a3736527062dcd","https://github.com/django/django/commit/4806731e58f3e8700a3c802e77899d54ac6021fe","https://github.com/django/django/commit/ad866a1ca3e7d60da888d25d27e46a8adb2ed36e"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-23969","published":"2023-02-01","fixed":"4.1.6","kev":false},{"cve":"CVE-2023-24580","published":"2023-02-15","fixed":"4.1.7","kev":false},{"cve":"CVE-2023-31047","published":"2023-05-07","fixed":"4.2.1","kev":false,"link":{"from":"CVE-2023-31047","to":"CVE-2023-36053","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.19","toFixed":"3.2.20","daysApart":57},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.1.9","toFixed":"4.1.10","daysApart":57}]}},{"cve":"CVE-2023-36053","published":"2023-07-03","fixed":"4.2.3","kev":false},{"cve":"CVE-2023-41164","published":"2023-11-03","fixed":"4.2.5","kev":false,"link":{"from":"CVE-2023-36053","to":"CVE-2023-41164","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.20","toFixed":"3.2.21","daysApart":123},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.1.10","toFixed":"4.1.11","daysApart":123}]}},{"cve":"CVE-2023-43665","published":"2023-11-03","fixed":"4.2.6","kev":false},{"cve":"CVE-2023-46695","published":"2023-11-02","fixed":"4.2.7","kev":false}],"package":"PyPI:Django"}}