CVE-2024-45230

A denial-of-service flaw exists in Django's urlize() and urlizetrunc() template filters, which automatically convert URLs and email addresses in text into clickable links. An attacker who can submit very large input containing a specific sequence of characters to a Django application that runs that input through these filters can cause excessive processing and make the application unresponsive. The attacker gains only service disruption — the CVSS score of 7.5 reflects high availability impact with no confidentiality or integrity loss. Any Django deployment on 5.1.x before 5.1.1, 5.0.x before 5.0.9, or 4.2.x before 4.2.16 that processes sizable untrusted text through these filters is affected, with the long-term-support 4.2 branch likely accounting for many still-running instances. No public proof-of-concept or confirmed in-the-wild exploitation is known, though EPSS assigns an elevated 25.8% probability of exploitation within 30 days (98th percentile).

What to do: Upgrade Django to 5.1.1, 5.0.9, or 4.2.16 (or later) depending on your branch. As an interim mitigation, audit templates and view code for use of urlize()/urlizetrunc() on untrusted data and avoid applying these filters to very large inputs, or pre-truncate/strip the input before filtering. Given the elevated EPSS score, prioritize patching internet-facing Django applications.