CVE-2024-39317: Wagtail regular expression denial-of-service via search query parsing

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-11 · updated 2026-06-17
Weakness: CWE-1333

Description

Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.

Affected products

wagtail: from 2.0 before 5.2.6; from 6.0 before 6.0.6; from 6.1 before 6.1.3 — fixed in 5.2.6, 6.0.6, 6.1.3

How to fix

Upgrade to a fixed version: wagtail 5.2.6, 6.0.6, 6.1.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-39317 or the next vulnerability affects your stack