QwikSec

Security Database

CVE

CWE

Training

CVE-2024-27351

Published: Mar 15, 2024

Modified: Nov 4, 2025

PUBLISHED

Description

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://groups.google.com/forum/#%21forum/django-announce

https://docs.djangoproject.com/en/5.0/releases/security/

https://www.djangoproject.com/weblog/2024/mar/04/security-releases/

FEDORA-2024-5c7fb64c74

vendor-advisory

FEDORA-2024-2ec03ca8cb

vendor-advisory

FEDORA-2024-84fbbbb914

vendor-advisory

[oss-security] 20240304 Django: CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()

mailing-list

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.