In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and…
Priority MEDIUM 44CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 6 fixed, 13 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02978 87th percentileScored 2026-11-07
Fix Partial Django (PyPI): 3.2.20, 4.1.10, 4.2.3Red Hat: 6 advisoriesRed Hat: 6 fixed, 13 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 3.2a1 to before 3.2.20 | 3.2.20 | Patch available | GHSA-jh3w-4vvf-mjgr |
| — | Django (PyPI) | 4.0a1 to before 4.1.10 | 4.1.10 | Patch available | GHSA-jh3w-4vvf-mjgr |
| — | Django (PyPI) | 4.2a1 to before 4.2.3 | 4.2.3 | Patch available | GHSA-jh3w-4vvf-mjgr |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 3.2a1 to before 3.2.20 Fixed in 3.2.20 Patch available GHSA-jh3w-4vvf-mjgr
- Django (PyPI) Vendor— Affected 4.0a1 to before 4.1.10 Fixed in 4.1.10 Patch available GHSA-jh3w-4vvf-mjgr
- Django (PyPI) Vendor— Affected 4.2a1 to before 4.2.3 Fixed in 4.2.3 Patch available GHSA-jh3w-4vvf-mjgr
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | 3.2 to before 3.2.20; 4.0 to before 4.1.10; 4.2 to before 4.2.3 | Vulnerable | djangoproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 3.2 to before 3.2.20; 4.0 to before 4.1.10; 4.2 to before 4.2.3 Vulnerable ·djangoproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-jh3w-4vvf-mjgr Django (PyPI) Fixed in 3.2.20 Advisory →
- Fix · GHSA-jh3w-4vvf-mjgr Django (PyPI) Fixed in 4.1.10 Advisory →
- Fix · GHSA-jh3w-4vvf-mjgr Django (PyPI) Fixed in 4.2.3 Advisory →
Red Hat 6 advisories
- RHSA-2024:1878 Released 2024-04-18 · Red Hat rating ModerateRHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements
- RHUI 4 for RHEL 8 python-aiohttp-3.9.2-1.el8ui, python-cryptography-41.0.6-1.el8ui, python-django-4.2.11-1.el8ui +7
- RHSA-2024:0212 Released 2024-01-16 · Red Hat rating ModerateRed Hat OpenStack Platform 17.1 (python-django) security update
- Red Hat OpenStack Platform 17.1 python-django-2.2.24-5.el9ost, python3-django-2.2.24-5.el9ost
- RHSA-2023:6818 Released 2023-11-08 · Red Hat rating ImportantSatellite 6.14 security and bug fix update
- Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33
Show 3 more Red Hat advisories
- RHSA-2023:5931 Released 2023-10-19 · Red Hat rating ImportantSatellite 6.13.5 Async Security Update
- Red Hat Satellite 6.13 for RHEL 8 foreman-3.5.1.23-1.el8sat, foreman-cli-3.5.1.23-1.el8sat, foreman-debug-3.5.1.23-1.el8sat +17
- RHSA-2023:4693 Released 2023-08-21 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-eda-controller-1.0.1-1.el8ap, automation-eda-controller-server-1.0.1-1.el8ap, automation-eda-controller-ui-1.0.1-1.el8ap +6
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-eda-controller-1.0.1-1.el9ap, automation-eda-controller-server-1.0.1-1.el9ap, automation-eda-controller-ui-1.0.1-1.el9ap +4
- RHSA-2023:4692 Released 2023-08-21 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-4.4.2-1.el8ap, automation-controller-venv-tower-4.4.2-1.el8ap
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-4.4.2-1.el9ap, automation-controller-venv-tower-4.4.2-1.el9ap
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Certification for Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.0 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix planned: Out of support scope |
| Red Hat Update Infrastructure 4 for Cloud Providers | Affected | No fix yet |
| RHUI 4 for RHEL 8 | Fixed | RHSA-2024:1878 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2023:4692, RHSA-2023:4693 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2023:4692, RHSA-2023:4693 |
| Red Hat OpenStack Platform 17.1 | Fixed | RHSA-2024:0212 |
| Red Hat Satellite 6.13 for RHEL 8 | Fixed | RHSA-2023:5931 |
| Red Hat Satellite 6.14 for RHEL 8 | Fixed | RHSA-2023:6818 |
Not affected: 7 products
- RHUI 4 for RHEL 8
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Satellite 6
- Red Hat Satellite 6.13 for RHEL 8
- Red Hat Satellite 6.14 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-36053
- 2026-10-03 Alias added: GHSA-jh3w-4vvf-mjgr
References
Advisory 5
Other 18
- https://groups.google.com/forum/#%21forum/django-announce
- https://docs.djangoproject.com/en/4.2/releases/security/
- [debian-lts-announce] 20230719 [SECURITY] [DLA 3500-1] python-django security update
- https://github.com/django/django/commit/454f2fb93437f98917283336201b4048293f7582
- https://github.com/django/django/commit/ad0410ec4f458aa39803e5f6b9a3736527062dcd
- https://github.com/django/django/commit/b7c5feb35a31799de6e582ad6a5a91a9de74e0f9
- https://github.com/django/django/commit/beb3f3d55940d9aa7198bf9d424ab74e873aec3d
- https://www.djangoproject.com/weblog/2023/jul/03/security-releases
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5DYKPNDCEHJQ3TKPJQO7QGSR4FAYMS
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NRDGTUN4LTI6HG4TWR3JYLSFVXPZT42A
- https://groups.google.com/forum/#!forum/django-announce
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-100.yaml
- https://github.com/django/django
- https://docs.djangoproject.com/en/4.2/releases/security
Sources
- CVE-2023-36053 · CVE Program
- CVE-2023-36053 · NVD
- FIRST EPSS
- GHSA-jh3w-4vvf-mjgr · GitHub Advisory Database · CC BY 4.0
- CVE-2023-36053 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences