Skip to content
OpenAdvisories
Medium USN-7501-1 1 CVE

python-django vulnerability

Published May 7, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Elias Myllymäki discovered that Django incorrectly handled stripping large
sequences of incomplete HTML tags. A remote attacker could possibly use
this issue to cause Django to consume resources, leading to a denial of
service.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS python-django 2:2.2.12-1ubuntu0.29
Ubuntu · 22.04 LTS 22.04:LTS python-django 2:3.2.12-2ubuntu1.18
Ubuntu · 24.04 LTS 24.04:LTS python-django 3:4.2.11-1ubuntu1.7

Vulnerabilities 1

  • Medium 5.3
    CVE-2025-32873 Public exploit EPSS 14%

    Django has a denial-of-service possibility in strip_tags()

    An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of inc…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2025-32873