CVE-2024-56374

What it actually does

Unbounded string length in private IPv6 validation functions (clean_ipv6_address, is_valid_ipv6_address) and django.forms.GenericIPAddressField permits excessive memory or CPU consumption during address parsing with no upper bound enforced.

Why it matters to the business

Attackers can remotely crash or degrade web application availability by sending crafted IPv6 strings through forms, increasing operational downtime risk for any Django deployment using the affected form field; stable low EPSS and absence from KEV indicate limited active exploitation but widespread package exposure still requires prompt patching.

How an attack unfolds

An attacker submits an excessively long or malformed IPv6 address string through any Django form that uses GenericIPAddressField; the validation routine processes the entire input without length limits, triggering high resource usage that can exhaust server capacity and cause denial of service.

How to fix it

Upgrade Django to 5.1.5, 5.0.11 or 4.2.18 or later; apply the exact fixed commits referenced for django/django; for Ubuntu packages listed, install the corresponding kernel or library updates that include the patched Django versions.

How to confirm the fix worked

Confirm Django version is at or above 5.1.5 / 5.0.11 / 4.2.18; test form submissions with long IPv6 strings to verify they are now rejected or truncated before resource exhaustion occurs; review changelog entries for the private IPv6 functions.

Typical attack path

1. Identify a Django application endpoint accepting user input via a form containing GenericIPAddressField
2. Craft and submit an IPv6 address string exceeding normal length bounds or containing repeated segments
3. Trigger the vulnerable clean_ipv6_address or is_valid_ipv6_address logic during form validation
4. Observe server resource exhaustion leading to slowed responses or crashes

How to detect it

Review web server and application logs for unusually long IPv6 strings submitted to form endpoints; look for spikes in CPU or memory usage coinciding with GenericIPAddressField validation calls; no specific threat actor campaigns or ransomware usage reported for this issue.

What your security team should do

• Immediately inventory all Django installations and prioritize upgrade to the fixed releases 5.1.5, 5.0.11 or 4.2.18
• Scan code for usage of django.forms.GenericIPAddressField and apply input length limits as a temporary control
• Monitor EPSS trend and CISA KEV for any future elevation in exploit activity