CVE-2023-43665: Django Denial-of-service in django.utils.text.Truncator

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-03 · updated 2026-06-17
Weakness: CWE-1284

Description

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

Affected products

Django: from 3.2 before 3.2.22; from 4.1 before 4.1.12; from 4.2 before 4.2.6 — fixed in 3.2.22, 4.1.12, 4.2.6
Fedoraproject Fedora: 39
Pypi Django: from 3.2 before 3.2.22; from 4.1 before 4.1.12; from 4.2 before 4.2.6; 3.2, 3.2.1, 3.2.10, 3.2.11, 3.2.12, 3.2.13 (+34) — fixed in 3.2.22, 4.1.12, 4.2.6

How to fix

Upgrade to a fixed version: Django 3.2.22, 4.1.12, 4.2.6; Pypi Django 3.2.22, 4.1.12, 4.2.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-43665 or the next vulnerability affects your stack