7.5
High
CVE-2023-36053 In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a…
Description
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| n/a | Versions not published | |
| debian_linux | 10.0 | No fix stated |
| fedora | 37 | No fix stated |
| Django | Versions not published |
References
- groups.google.com groups.google.com
- docs.djangoproject.com docs.djangoproject.com
- www.djangoproject.com www.djangoproject.com
- [debian-lts-announce] 20230719 [SECURITY] [DLA 3500-1] python-django security update lists.debian.org
- DSA-5465 www.debian.org
- FEDORA-2023-cc023fabb7 lists.fedoraproject.org
- FEDORA-2023-9d36d373f1 lists.fedoraproject.org
- FEDORA-2024-84fbbbb914 lists.fedoraproject.org
Timeline
- Published
- Last modified
Other CVEs of n/a
The 144658 CVEs of n/a →
CVE-2026-106713
An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the…
Not rated
CVE-2026-106715
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin…
Not rated
CVE-2026-106714
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it…
Not rated
CVE-2026-106716
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep…
Not rated