Django up to 4.2.19/5.0.12/5.1.6 Template Filter django.utils.text.wrap denial of service

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Django up to 4.2.19/5.0.12/5.1.6. This vulnerability affects the function django.utils.text.wrap of the component Template Filter Handler. This manipulation causes denial of service. This vulnerability appears as CVE-2025-26699. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Django up to 4.2.19/5.0.12/5.1.6. Affected by this vulnerability is the function django.utils.text.wrap of the component Template Filter Handler. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

The advisory is shared at seclists.org. This vulnerability is known as CVE-2025-26699 since 02/14/2025. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 232266 (Linux Distros Unpatched Vulnerability : CVE-2025-26699), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.2.20, 5.0.13 or 5.1.7 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (232266) and CERT Bund (WID-SEC-2025-0500). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Debian Linux
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Gentoo Linux
• SUSE openSUSE
• Red Hat Ansible Automation Platform
• Open Source Django

Productinfo

Type

• Content Management System

Name

• Django

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2.8
• 4.2.9
• 4.2.10
• 4.2.11
• 4.2.12
• 4.2.13
• 4.2.14
• 4.2.15
• 4.2.16
• 4.2.17
• 4.2.18
• 4.2.19
• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9
• 5.0.10
• 5.0.11
• 5.0.12
• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion