Executive brief
Django is a widely-used Python web framework for building web applications. The `check_for_language()` function has a vulnerability that allows attackers to trigger memory exhaustion by submitting many distinct, very long language codes. While the impact is bounded by request size limits, an attacker can exhaust application memory and degrade service availability.
Technical details
The vulnerability is a denial-of-service flaw in `django.utils.translation.check_for_language()` caused by unbounded caching of language codes as dictionary keys in process memory. The function is called by `django.views.i18n.set_language()`, which accepts user-controlled language codes from request data. An attacker can submit many distinct, very long language codes to exhaust available memory. The impact is bounded by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache's fixed maximum entry count, but a well-crafted attack can still force memory pressure and service degradation. Patches are available in Django 5.2.17, 6.0.8, and 6.1.
Affected products
- Django Django 5.2 before 5.2.17, 6.0 before 6.0.8, and unsupported series (5.1.x, 5.0.x, 4.2.x)
Timeline
- 2026-08-04: disclosed: CVE-2026-15337 published and patches released for Django 5.2.17, 6.0.8, and 6.1