CVE-2024-24680

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

3591e1c1acbd7c13174275367c3fdf012cb0413b

Fixed

f5c880857e8e01b006c75b9e79a9088cc2c6228f

Introduced

879e5d587b84e6fc961829611999431778eb9f6a

Fixed

a684d73fc9ad94bbc535385d8b1d7c05ea06702f

Introduced

52821001bb62b764d73e63812133f199b8fef9eb

Fixed

428d06ccef09e70bcef9869c5a9404863b2fc7d8

Database specific

{
    "versions": [
        {
            "introduced": "3.2"
        },
        {
            "fixed": "3.2.24"
        },
        {
            "introduced": "4.2"
        },
        {
            "fixed": "4.2.10"
        },
        {
            "introduced": "5.0"
        },
        {
            "fixed": "5.0.2"
        }
    ]
}

Affected versions

4.*

4.2

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.2.8

4.2.9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-24680.json"