← Back to CVE Explorer

CVE-2026-15337

Full vulnerability record from the local CVENow database.

Description

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jaeyoung Jang for reporting this issue.

Severity
MEDIUM
CVSS score
6.9 (v4.0)
Vulnerability status
Analyzed
Source identifier
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
Published
2026-08-04 17:16:46.453000
Last modified
2026-10-24 16:10:00.153000
View original CVE JSON 
{
  "id": "CVE-2026-15337",
  "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
  "published": "2026-08-04T17:16:46.453",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Jaeyoung Jang for reporting this issue."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en Django 5.2 anterior a 5.2.17 y 6.0 anterior a 6.0.8.\ndjango.utils.translation.check_for_language() está sujeto a un posible ataque de denegación de servicio cuando se le proporcionan muchos códigos de idioma distintos y muy largos, los cuales se retienen como claves en una caché en memoria y consumen memoria del proceso. Dichos códigos llegan a la función a través de la vista django.views.i18n.set_language(), la cual no está enrutada por defecto. La memoria consumida está limitada, ya que los datos de la solicitud están limitados por la configuración DATA_UPLOAD_MAX_MEMORY_SIZE (por defecto 2.5 MB) y la caché mantiene un número máximo fijo de entradas.\nSeries de Django anteriores y no soportadas (como 5.1.x, 5.0.x y 4.2.x) no fueron evaluadas y también podrían estar afectadas.\nDjango desea agradecer a Jaeyoung Jang por reportar este problema."
    }
  ],
  "affected": [
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "affectedData": [
        {
          "vendor": "djangoproject",
          "product": "Django",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.org/project/Django/",
          "packageName": "django",
          "repo": "https://github.com/django/django/",
          "versions": [
            {
              "version": "6.0",
              "lessThan": "6.0.8",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "6.0.8",
              "versionType": "python",
              "status": "unaffected"
            },
            {
              "version": "5.2",
              "lessThan": "5.2.17",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "5.2.17",
              "versionType": "python",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-04T17:15:59.533868Z",
          "id": "CVE-2026-15337",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.2.17",
              "matchCriteriaId": "36AF9FD9-D477-457E-991A-66F40DB48637"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0",
              "versionEndExcluding": "6.0.8",
              "matchCriteriaId": "D2E4E199-5735-4911-92F2-73B0AA1D173E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.djangoproject.com/en/dev/releases/security/",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/django/django/commit/224dbc832586ad5cfb0237c2ff30d14baeaddc6f",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/django/django/commit/27137e655e442e81095f1f8f77ff3870d9fdf169",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/django/django/commit/5b3523d29be25948e1dd90b3863a002f00fc865f",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/django/django/commit/c72a5dbb64d0777f3f471f1be94e8b2ca91e0959",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://groups.google.com/g/django-announce",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Mailing List"
      ]
    },
    {
      "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}