CVE-2025-32873
Medium · 5.3Django has a denial-of-service possibility in strip_tags()
CVSS
5.3
EPSS
14.3%
Published
May 8, 2025
CISA due date
—
The record
An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | django | 4.2 | 4.2.21 |
| PyPI | django | 5.1 | 5.1.9 |
| PyPI | django | 5.2 | 5.2.1 |
| Bitnami | django | 4.2.0 | 4.2.21 |
| Bitnami | django | 4.2.0 | 5.0.3 |
| Chainguard | awx | 0 | 24.6.1-r6 |
| Chainguard | grafana-oncall | 0 | 1.16.1-r0 |
| Chainguard | grafana-oncall-compat | 0 | 1.16.1-r0 |
| Debian:11 | python-django | 0 | No fix |
| Debian:12 | python-django | 0 | No fix |
| Debian:13 | python-django | 0 | No fix |
| Debian:13 | python-django | 0 | 3:4.2.21-1 |
| Debian:14 | python-django | 0 | 3:4.2.21-1 |
| Mageia:9 | python-django | 0 | 4.1.13-1.4.mga9 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | python-Django | 0 | 4.2.11-150600.3.21.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python-Django | 0 | 4.2.11-150600.3.21.1 |
| Wolfi | grafana-oncall | 0 | 1.16.1-r0 |
| Wolfi | grafana-oncall-compat | 0 | 1.16.1-r0 |
| openSUSE:Leap 15.6 | python-Django | 0 | 4.2.11-150600.3.21.1 |
| openSUSE:Tumbleweed | python-Django | 0 | 5.2.1-1.1 |
| openSUSE:Tumbleweed | python-Django4 | 0 | 4.2.21-1.1 |
| openSUSE:Tumbleweed | python-Django6 | 0 | 6.0-1.1 |
| pypi | Django | 4.2 | No fix |
| pypi | Django | 5.1 | No fix |
| pypi | Django | 5.2 | No fix |
Related vulnerabilities
- GHSA-8p8v-wh79-9r56 Django vulnerable to Uncontrolled Resource Consumption Also affects django
- GHSA-mjgh-79qc-68w3 Django has a Race Condition vulnerability Also affects django
- CVE-2026-25673 An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Also affects django
- CVE-2026-25674 An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Also affects django
- GHSA-6426-9fv3-65x8 Django has an SQL Injection issue Also affects django
- GHSA-gvg8-93h5-g6qq Django has an SQL Injection issue Also affects django
- GHSA-2mcm-79hx-8fxw Django has Observable Timing Discrepancy Also affects django
- GHSA-33mw-q7rj-mjwj Django has Inefficient Algorithmic Complexity Also affects django