# CVE-2010-4535: Django denial of service in password reset timestamp handling

Source: https://junglewise.ai/threats/cve-2010-4535-django-denial-of-service-in-password-reset-timestamp-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-23. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2010-4535 · Severity: high · CVSS 7.5 · Published 2018-07-23

A vulnerability in the Django web framework's password reset system could allow an attacker to crash the application. By sending a specially crafted web request with an extremely long timestamp, an attacker can force the server to consume excessive system resources. This can lead to a denial of service, making the website unavailable to legitimate users.

Technologies: [Django (PyPI)](https://junglewise.ai/threats/technologies/django). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2010-4535 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2010-4535 being exploited in the wild.

**How severe is CVE-2010-4535?** High severity, with a CVSS score of 7.5, published 23 July 2018.

**Which products and versions are affected?** Django (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.3, ECOSYSTEM:introduced=0,fixed=1.1.3,introduced=1.2,fixed=1.2.4, ECOSYSTEM:introduced=0,fixed=1.1.3|ECOSYSTEM:introduced=1.2,fixed=1.2.4.

**Is there a fix for CVE-2010-4535?** Yes. Django (PyPI): upgrade to 1.1.3, 1.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2010-4535 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2010-4535?** Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Django (PyPI): upgrade to 1.1.3, 1.2.4 or later

  ```sh
  pip install "Django>=1.2.4"
  ```


## Technical details

The vulnerability exists within the 'django.contrib.auth' component of the Django web framework. Specifically, the password reset mechanism does not perform length validation on the string representing a base36 timestamp provided in the reset URL. A remote, unauthenticated attacker can exploit this by submitting a URL containing an arbitrarily large base36 integer, leading to excessive CPU and memory consumption during processing. This resource exhaustion results in a denial of service (DoS) condition. The issue is resolved in Django versions 1.1.3, 1.2.4, and 1.3 beta 1.

## Affected products

- Django Project Django < 1.1.3, >= 1.2, < 1.2.4, 1.3 beta 1

## Identifiers

- CVE-2010-4535
- GHSA-7wph-fc4w-wqp2
- PYSEC-2011-29
- PYSEC-2011-9

## Timeline

- 2010-12-22: advisory: Django security release announcement
- 2011-01-10: disclosed: NVD publication date
- 2018-07-23: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/MarkLee131](https://api.github.com/users/MarkLee131)
- [https://github.com/MarkLee131](https://github.com/MarkLee131)
- [https://api.github.com/users/MarkLee131/gists%7B/gist_id%7D](https://api.github.com/users/MarkLee131/gists%7B/gist_id%7D)
- [https://api.github.com/users/MarkLee131/repos](https://api.github.com/users/MarkLee131/repos)
- [https://avatars.githubusercontent.com/u/38575222?v=4](https://avatars.githubusercontent.com/u/38575222?v=4)
- [https://api.github.com/users/MarkLee131/events%7B/privacy%7D](https://api.github.com/users/MarkLee131/events%7B/privacy%7D)

## Related threats

- [Django GeoDjango unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service)
- [Django GeoDjango spatial lookups file write and request forgery](https://junglewise.ai/threats/cve-2026-15307-django-geodjango-spatial-lookups-file-write-and-request-forgery)
- [PYSEC-2026-2449 - Django has a Race Condition vulnerability](https://junglewise.ai/threats/cve-2026-25674-django-has-a-race-condition-vulnerability)
- [PYSEC-2026-1296 - Django vulnerable to partial directory traversal via archives](https://junglewise.ai/threats/cve-2025-59682-django-vulnerable-to-partial-directory-traversal-via-archives)
- [Django DomainNameValidator header injection via newline characters](https://junglewise.ai/threats/cve-2026-53878-django-domainnamevalidator-header-injection-via-newline)