Skip to content
OpenAdvisories
Medium USN-7501-2 1 CVE

python-django vulnerability

Published May 7, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

USN-7501-1 fixed a vulnerability in Django. This update provides
the corresponding update for Ubuntu 18.04 LTS.

Original advisory details:

Elias Myllymäki discovered that Django incorrectly handled stripping large
sequences of incomplete HTML tags. A remote attacker could possibly use
this issue to cause Django to consume resources, leading to a denial of
service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS python-django 1:1.11.11-1ubuntu1.21+esm11

Vulnerabilities 1

  • Medium 5.3
    CVE-2025-32873 Public exploit EPSS 14%

    Django has a denial-of-service possibility in strip_tags()

    An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of inc…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2025-32873