CVE-2024-24680: Django denial-of-service attack in the intcomma template filter

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-06 · updated 2026-06-17

Description

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

Affected products

Django: from 3.2 before 3.2.24; from 4.2 before 4.2.10; from 5.0 before 5.0.2 — fixed in 3.2.24, 4.2.10, 5.0.2
Pypi Django: from 3.2 before 3.2.24; from 4.2 before 4.2.10; from 5.0 before 5.0.2; 3.2, 3.2.1, 3.2.10, 3.2.11, 3.2.12, 3.2.13 (+30) — fixed in 3.2.24, 4.2.10, 5.0.2

How to fix

Upgrade to a fixed version: Django 3.2.24, 4.2.10, 5.0.2; Pypi Django 3.2.24, 4.2.10, 5.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-24680 or the next vulnerability affects your stack