{"id":"CVE-2024-27351","published":"2024-03-15T00:00:00Z","modified":"2025-11-04T18:30:07Z","title":"In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.01854,"percentile":0.79169,"provenance":"source"},"cwes":[{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity"}],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":[]},{"url":"https://docs.djangoproject.com/en/5.0/releases/security/","tags":[]},{"url":"https://www.djangoproject.com/weblog/2024/mar/04/security-releases/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/04/1","tags":["mailing-list"]},{"url":"https://github.com/django/django/commit/3394fc6132436eca89e997083bae9985fb7e761e","tags":[]},{"url":"https://github.com/django/django/commit/3c9a2771cc80821e041b16eb36c1c37af5349d4a","tags":[]},{"url":"https://github.com/django/django/commit/072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX/","tags":[]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":15.83},{"name":"CVSS severity","points":3.71}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=3.2, <3.2.25",">=4.2, <4.2.11",">=5.0, <5.0.3"],"patched":["3.2.25","4.2.11","5.0.3"],"from":["GHSA-vm8q-m57g-pff3","PYSEC-2024-47"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0039","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2019-14232","parents":[{"from":"CVE-2019-14232","to":"CVE-2024-27351","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.","from":"CVE.org","in":"CVE-2024-27351"}]},{"from":"CVE-2023-43665","to":"CVE-2024-27351","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.","from":"CVE.org","in":"CVE-2024-27351"},{"kind":"similar","provenance":"machine","score":0.62,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-43665","published":"2023-11-03","fixed":"4.2.6","kev":false},{"cve":"CVE-2023-46695","published":"2023-11-02","fixed":"4.2.7","kev":false},{"cve":"CVE-2024-24680","published":"2024-02-06","fixed":"5.0.2","kev":false,"link":{"from":"CVE-2024-24680","to":"CVE-2024-27351","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.24","toFixed":"3.2.25","daysApart":38},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.2.10","toFixed":"4.2.11","daysApart":38}]}},{"cve":"CVE-2024-27351","published":"2024-03-15","fixed":"5.0.3","kev":false},{"cve":"CVE-2024-38875","published":"2024-07-10","fixed":"5.0.7","kev":false},{"cve":"CVE-2024-39329","published":"2024-07-10","fixed":"5.0.7","kev":false},{"cve":"CVE-2024-39330","published":"2024-07-10","fixed":"5.0.7","kev":false}],"package":"PyPI:Django"}}