Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-04T15:48:25 django: Django: Denial-of-service vulnerability due to excessive memory consumption 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-1050

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jaeyoung Jang for reporting this issue.

A flaw was found in Django. A remote attacker could trigger a denial-of-service (DoS) condition by sending many distinct, very long language codes to the `django.utils.translation.check_for_language()` function. These codes are stored in an in-memory cache, leading to excessive memory consumption. While the memory usage is bounded by configuration settings, this vulnerability could still impact system availability.

Moderate: This denial-of-service vulnerability in Django arises from excessive memory consumption when processing specially crafted, long language codes. The impact is mitigated in Red Hat products as the affected `django.views.i18n.set_language()` view is not routed by default, limiting exposure to this flaw. Exploitation would require explicit routing of this view within a Django application. To mitigate this issue, ensure that the `django.views.i18n.set_language()` view remains unrouted in Django applications. If custom routing exposes this view, restrict access to trusted networks or implement input validation to limit the length and number of language codes processed. Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/eda-controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/hub-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/ansible-dev-tools-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/eda-controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/gateway-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/hub-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/ansible-dev-tools-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/hub-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/aap-cloud-billing-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/ansible-dev-tools-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/hub-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/metrics-service-rhel9 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform/automation-dashboard-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-tech-preview/metrics-service-rhel9 Red Hat Ansible Automation Platform 2 Out of support scope automation-controller Red Hat Ansible Automation Platform 2 Fix deferred python-django Red Hat Discovery 2 Fix deferred discovery/discovery-server-rhel9 Red Hat OpenStack Platform 16.2 Out of support scope python-django20 Red Hat OpenStack Platform 17.1 Out of support scope python-django Red Hat OpenStack Platform 18.0 Fix deferred python-django Red Hat Satellite 6 Fix deferred python-django Red Hat Satellite 6 Fix deferred satellite-capsule:el8/python-django Red Hat Satellite 6 Fix deferred satellite/iop-advisor-backend-rhel9 Red Hat Update Infrastructure 4 for Cloud Providers Out of support scope python-django Red Hat Update Infrastructure 5 Fix deferred rhui5/rhua-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-15337 https://nvd.nist.gov/vuln/detail/CVE-2026-15337 https://docs.djangoproject.com/en/dev/releases/security/ https://github.com/django/django/commit/224dbc832586ad5cfb0237c2ff30d14baeaddc6f https://github.com/django/django/commit/27137e655e442e81095f1f8f77ff3870d9fdf169 https://github.com/django/django/commit/5b3523d29be25948e1dd90b3863a002f00fc865f https://github.com/django/django/commit/c72a5dbb64d0777f3f471f1be94e8b2ca91e0959 https://groups.google.com/g/django-announce https://www.djangoproject.com/weblog/2026/aug/04/security-releases/