CVE-2024-38875

What it actually does

The urlize and urlizetrunc template filters in Django enter a computationally expensive path when processing inputs containing a very large number of brackets, leading to excessive CPU and memory consumption that can exhaust server resources.

Why it matters to the business

Web applications built on affected Django versions may experience sudden slowdowns or complete unavailability when processing crafted inputs, resulting in disrupted user access and potential revenue or productivity loss until the service recovers.

How an attack unfolds

An attacker identifies a Django application endpoint that applies the urlize or urlizetrunc filter to user-supplied data and submits a request containing a string engineered with an extremely high bracket count, triggering resource exhaustion on the server.

How to fix it

Upgrade Django to version 4.2.14 or 5.0.7 or later. For Debian 12 systems apply the package update that resolves the issue in version 6.1.94-1; for Debian 13 apply the update that resolves the issue in version 6.8.11-1. Where immediate patching is not possible, avoid applying the vulnerable filters to untrusted input.

How to confirm the fix worked

Confirm the installed Django version is at least 4.2.14 or 5.0.7 and verify that the Debian package versions listed in the fixed_versions have been applied. Test the urlize and urlizetrunc filters with known bracket-heavy inputs to ensure they complete without excessive resource usage.

Typical attack path

1. Locate a publicly reachable Django view or template that invokes urlize or urlizetrunc on input derived from HTTP requests or parameters
2. Craft a payload consisting of a very large number of opening and closing brackets
3. Transmit the payload via GET, POST, or other input channels accepted by the endpoint
4. Observe sustained high resource utilization on the application server leading to denial of service

How to detect it

Inspect web server and application logs for requests containing unusually long sequences of brackets or repeated bracket characters; correlate with spikes in CPU or memory usage on Django worker processes. Review access logs for high-volume requests to endpoints known to invoke urlize or urlizetrunc.

What your security team should do

• Apply the listed Django or Debian package updates within the next maintenance window
• Review all templates and views that use urlize or urlizetrunc and restrict their use on untrusted data until patched
• Monitor application performance metrics for sudden spikes in CPU or memory that coincide with requests containing high bracket counts