CVE-2024-39317: Torchbox Wagtail

Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days.

Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.

Affected products

• Torchbox Wagtail: from 2.0, before 5.2.6 (fixed in 5.2.6); from 6.0, before 6.0.6 (fixed in 6.0.6); from 6.1, before 6.1.3 (fixed in 6.1.3)

Published 2024-07-11. Last modified 2026-06-17.