CVE-2023-36053 Django has regular expression denial of service vulnerability in EmailValidator/URLValidator
Attackers can cause denial of service in Django applications by submitting emails or URLs with excessive domain labels, triggering inefficient regex processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-36053?
CVE-2023-36053 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 3 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Weakness: CWE-1333
Which versions are affected by CVE-2023-36053?
8 open source packages ship an affected version, including django and Django. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
django Bitnami | From 3.2.0 | 3.2.20, 4.1.10, 4.2.3 |
django PyPI | From 3.2a1 | 3.2.20 |
django PyPI | From 4.0a1 | 4.1.10 |
django PyPI | From 4.2 | 4.2.3, 4.1.10, 3.2.20 |
django PyPI | From 4.2a1 | 4.2.3 |
Django PyPI | From 3.2a1 | 3.2.20 |
2 more packages
Django PyPI | From 4.0a1 | 4.1.10 |
Django PyPI | From 4.2a1 | 4.2.3 |
Linux distribution packages (14)
python-django Red Hat:openstack:17.1::el9 | All versions | 0:2.2.24-5.el9ost |
python3-django Red Hat:openstack:17.1::el9 | All versions | 0:2.2.24-5.el9ost |
python-Django SUSE:HPE Helion OpenStack 8 | All versions | 1.11.29-3.48.1 |
python-Django SUSE:OpenStack Cloud 8 | All versions | 1.11.29-3.48.1 |
python-Django1 SUSE:OpenStack Cloud 9 | All versions | 1.11.29-3.47.1 |
python-Django SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.11.29-3.48.1 |
python-Django1 SUSE:OpenStack Cloud Crowbar 9 | All versions | 1.11.29-3.47.1 |
python-Django SUSE:Package Hub 15 SP4 | All versions | 2.2.28-bp154.2.12.1 |
python-Django1 SUSE:Package Hub 15 SP4 | All versions | 1.11.29-bp154.2.6.1 |
python-Django1 SUSE:Package Hub 15 SP5 | All versions | 1.11.29-bp155.4.3.1 |
python-Django openSUSE:Leap 15.4 | All versions | 2.2.28-bp154.2.12.1 |
python-Django1 openSUSE:Leap 15.4 | All versions | 1.11.29-bp154.2.6.1 |
python-Django1 openSUSE:Leap 15.5 | All versions | 1.11.29-bp155.4.3.1 |
python-Django openSUSE:Tumbleweed | All versions | 4.2.3-1.1 |
Products include Debian Debian Linux, Djangoproject Django, Fedoraproject Fedora.
How do I fix CVE-2023-36053?
Upgrade django to a fixed version for your release line: 3.2.20, 4.1.10 or 4.2.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-36053 being exploited?
There is no known exploitation of CVE-2023-36053 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-django-2023-36053, CLSA-2026-1787036530, DEBIAN-CVE-2023-36053, DLA-3500-1, DSA-5465-1, GHSA-jh3w-4vvf-mjgr and 13 more.