Vulnerability details
CVE-2026-1285
djangoproject Django
Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
CVSS 3.1
7.5High
Official description
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| djangoproject | Django | 4.2 ≤ v < 4.2.28 | CVEProject cvelistV5 (CNA) |
| djangoproject | Django | 5.2 ≤ v < 5.2.11 | CVEProject cvelistV5 (CNA) |
| djangoproject | Django | 6.0 ≤ v < 6.0.2 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://docs.djangoproject.com/en/dev/releases/security/ vendor-advisory
- https://groups.google.com/g/django-announce mailing-list
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases/ vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-02-03
- Last updated
- 2026-02-03
- State
- Published
- Assigner (CNA)
- DSF
Exploit prediction (EPSS)
1.11%
Probability of exploitation in 30 days
66.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-407Inefficient Algorithmic Complexity