CVE-2024-41991: Djangoproject Django

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

Affected products

• Djangoproject Django: from 4.2, before 4.2.15 (fixed in 4.2.15); from 5.0, before 5.0.8 (fixed in 5.0.8)

Published 2024-08-07. Last modified 2026-06-17.