The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as…
Priority LOW 17CWE-399Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-399 and the CVSS impact.
Summary
The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.
Why it matters now
EPSS 0.01799 78th percentileScored 2026-11-07
Fix Fixed Django (PyPI): 0.96.1, 0.95.2, 0.91.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 0.96.0 to before 0.96.1 | 0.96.1 | Patch available | GHSA-9v8h-57gv-qch6 |
| — | Django (PyPI) | 0.95 to before 0.95.2 | 0.95.2 | Patch available | GHSA-9v8h-57gv-qch6 |
| — | Django (PyPI) | 0.91.0 to before 0.91.1 | 0.91.1 | Patch available | GHSA-9v8h-57gv-qch6 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 0.96.0 to before 0.96.1 Fixed in 0.96.1 Patch available GHSA-9v8h-57gv-qch6
- Django (PyPI) Vendor— Affected 0.95 to before 0.95.2 Fixed in 0.95.2 Patch available GHSA-9v8h-57gv-qch6
- Django (PyPI) Vendor— Affected 0.91.0 to before 0.91.1 Fixed in 0.91.1 Patch available GHSA-9v8h-57gv-qch6
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:django_project:django:0.91:*:*:*:*:*:*:* | 0.91 | Vulnerable | Django Project |
| cpe:2.3:a:django_project:django:0.95:*:*:*:*:*:*:* | 0.95 | Vulnerable | Django Project |
| cpe:2.3:a:django_project:django:0.95.1:*:*:*:*:*:*:* | 0.95.1 | Vulnerable | Django Project |
| cpe:2.3:a:django_project:django:0.96:*:*:*:*:*:*:* | 0.96 | Vulnerable | Django Project |
- cpe:2.3:a:django_project:django:0.91:*:*:*:*:*:*:* Versions 0.91 Vulnerable ·Django Project
- cpe:2.3:a:django_project:django:0.95:*:*:*:*:*:*:* Versions 0.95 Vulnerable ·Django Project
- cpe:2.3:a:django_project:django:0.95.1:*:*:*:*:*:*:* Versions 0.95.1 Vulnerable ·Django Project
- cpe:2.3:a:django_project:django:0.96:*:*:*:*:*:*:* Versions 0.96 Vulnerable ·Django Project
Remediation
- Fix · GHSA-9v8h-57gv-qch6 Django (PyPI) Fixed in 0.96.1 Advisory →
- Fix · GHSA-9v8h-57gv-qch6 Django (PyPI) Fixed in 0.95.2 Advisory →
- Fix · GHSA-9v8h-57gv-qch6 Django (PyPI) Fixed in 0.91.1 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2007-5712
- 2026-10-03 Alias added: GHSA-9v8h-57gv-qch6
References
Advisory 5
Other 10
- http://sourceforge.net/forum/forum.php?forum_id=749199
- https://github.com/django/django/commit/412ed22502e11c50dbfee854627594f0e7e2c234
- https://github.com/django/django/commit/7dd2dd08a79e388732ce00e2b5514f15bd6d0f6f
- https://github.com/django/django/commit/8bc36e726c9e8c75c681d3ad232df8e882aaac81
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2007-1.yaml
- https://web.archive.org/web/20091201070224/http://secunia.com/advisories/27435
- https://web.archive.org/web/20111224195100/http://secunia.com/advisories/27597
- https://web.archive.org/web/20111229085535/http://secunia.com/advisories/31961
- https://web.archive.org/web/20200228183657/http://www.securityfocus.com/bid/26227
More Django Project Django vulnerabilities
- TI-2007-00394 bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking… CVSS 2.0HIGH 7.5
- TI-2007-05594 Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows… CVSS 2.0MEDIUM 6.8
- TI-2007-00395 The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly… CVSS 2.0MEDIUM 6.5
- TI-2009-02541 The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not… CVSS 2.0MEDIUM 5.0
- TI-2008-02208 Cross-site scripting (XSS) vulnerability in the login form in the administration… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2007-5712 · CVE Program
- CVE-2007-5712 · NVD
- FIRST EPSS
- GHSA-9v8h-57gv-qch6 · GitHub Advisory Database · CC BY 4.0
- CVE-2007-5712 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences