CVE-2023-36053: Django has regular expression denial of service vulnerability in EmailValidator/URLValidator

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-03 · updated 2026-06-17
Weakness: CWE-1333

Description

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

Affected products

Debian Linux: 10.0, 11.0, 12.0
Django: from 3.2 before 3.2.20; from 4.0 before 4.1.10; from 4.2 before 4.2.3 — fixed in 3.2.20, 4.1.10, 4.2.3
Fedoraproject Fedora: 37, 38
Pypi Django: from 4.2 before 4.2.3; from 4.0 before 4.1.10; from 3.2 before 3.2.20; 3.2, 3.2.1, 3.2.10, 3.2.11, 3.2.12, 3.2.13 (+41) — fixed in 4.2.3, 4.1.10, 3.2.20

How to fix

Upgrade to a fixed version: Django 3.2.20, 4.1.10, 4.2.3; Pypi Django 4.2.3, 4.1.10, 3.2.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-36053 or the next vulnerability affects your stack