Vulnerability advisory

BIT-django-2025-26699

Published Mar 10, 2025Updated Sep 8, 2026OSV record ↗

Also known as CVE-2025-26699GHSA-p3fp-8748-vqfqPYSEC-2025-13

Severity

Severity not reported.

Affected versions

django Bitnami

Affected Fixed in

4.2.0 to before 5.1.7 5.1.7

Affected	Fixed in
`4.2.0` to before 5.1.7	`5.1.7`
Severity for this package CVSS 3.x`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Severity for this package

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

References

Advisorydocs.djangoproject.com/en/dev/releases/security/ ↗
Advisorygroups.google.com/g/django-announce ↗
Advisorywww.djangoproject.com/weblog/2025/mar/06/security-releases/ ↗
DISCUSSIONwww.openwall.com/lists/oss-security/2025/03/06/12 ↗
Advisorylists.debian.org/debian-lts-announce/2025/03/msg00012.html ↗
Webnvd.nist.gov/vuln/detail/CVE-2025-26699 ↗