CVE-2010-4535: Djangoproject Django

Medium severity, CVSS 5.0. EPSS: 3.4% chance of exploitation in the next 30 days.

The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.

Affected products

• Djangoproject Django: up to and including 1.1.2; version 0.91 only; version 0.95 only; version 0.95.1 only; version 0.96 only; version 1.0 only; …

Published 2011-01-10. Last modified 2026-06-16.