CVE-2024-56374
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)
02 / AFFECTED SOFTWARE
Affected packages
34 explicit affected versions
34 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions `clean_ipv6_address` and `is_valid_ipv6_address` are vulnerable, as is the `django.forms.GenericIPAddressField` form field. (The django.db.models.GenericIPAddressField model field is not affected.)
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)
05 / REFERENCES
Further evidence
- http://www.openwall.com/lists/oss-security/2025/01/14/2
- https://docs.djangoproject.com/en/dev/releases/security/
- https://github.com/advisories/GHSA-qcgg-j2x8-h9g8
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/jan/14/security-releases/
- https://docs.djangoproject.com/en/dev/releases/security
- https://github.com/django/django
- https://github.com/django/django/commit/4806731e58f3e8700a3c802e77899d54ac6021fe
- https://github.com/django/django/commit/ad866a1ca3e7d60da888d25d27e46a8adb2ed36e
- https://github.com/django/django/commit/ca2be7724e1244a4cb723de40a070f873c6e94bf
- https://github.com/django/django/commit/e8d4a2005955dcf962193600b53bf461b190b455
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-1.yaml
- https://lists.debian.org/debian-lts-announce/2025/01/msg00024.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-56374
- https://www.djangoproject.com/weblog/2025/jan/14/security-releases
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56374.json