CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-56374: An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings...
5.8
CVSS
Description
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)
Classification
CVE ID: CVE-2024-56374
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.8
Affected Products
Vendor: djangoproject
Product: Django
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 17.78% (scored less or equal to compared to others)
EPSS Date: 2025-02-12 (when was this score calculated)
References
https://docs.djangoproject.com/en/dev/releases/security/https://groups.google.com/g/django-announce
https://www.djangoproject.com/weblog/2025/jan/14/security-releases/