Executive brief
Django, a popular web framework, contains a flaw in how it processes text containing HTML tags. An attacker can send specially crafted text with many unmatched HTML tags to a website, causing the server to slow down or become unresponsive. This could lead to a service outage, preventing legitimate users from accessing the site.
Technical details
A vulnerability exists in the `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (when `html=True`), as well as the `truncatechars_html` and `truncatewords_html` template filters. The root cause is inefficient algorithmic complexity (CWE-407) when parsing HTML with a large number of unmatched end tags. A remote, unauthenticated attacker can exploit this via the network by submitting crafted input to any application component that uses these truncation methods on user-supplied data. This results in excessive CPU consumption, leading to a denial-of-service (DoS) condition. The issue is resolved in Django versions 6.0.2, 5.2.11, and 4.2.28.
Affected products
- Django Software Foundation Django >= 6.0a1, < 6.0.2; >= 5.2a1, < 5.2.11; >= 4.2a1, < 4.2.28
Timeline
- 2026-02-03: disclosed
- 2026-02-03: advisory
- 2026-02-03: patched
References
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases
- https://github.com/django/django/commit/a33540b3e20b5d759aa8b2e4b9ca0e8edd285344
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-45.yaml