Read the docs
TI-2024-26273 Aliases CVE-2024-39317GHSA-jmp3-39vp-fwg8

Wagtail regular expression denial-of-service via search query parsing

Priority LOW 30CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0061 49th percentileScored 2026-11-07
Fix Fixed wagtail (wagtail): 5.2.6, 6.0.6, 6.1.3wagtail (PyPI): 6.0.6, 6.1.3, 5.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wagtailwagtail2.0 to before 5.2.6; 6.0 to before 6.0.6; 6.1 to before 6.1.35.2.6, 6.0.6, 6.1.3Patch availableCNA
—wagtail (PyPI)6.0 to before 6.0.66.0.6Patch availableGHSA-jmp3-39vp-fwg8
—wagtail (PyPI)6.1 to before 6.1.36.1.3Patch availableGHSA-jmp3-39vp-fwg8
—wagtail (PyPI)2.0 to before 5.2.65.2.6Patch availableGHSA-jmp3-39vp-fwg8
  • wagtail Vendorwagtail Affected 2.0 to before 5.2.6; 6.0 to before 6.0.6; 6.1 to before 6.1.3 Fixed in 5.2.6, 6.0.6, 6.1.3 Patch available CNA
  • wagtail (PyPI) Vendor— Affected 6.0 to before 6.0.6 Fixed in 6.0.6 Patch available GHSA-jmp3-39vp-fwg8
  • wagtail (PyPI) Vendor— Affected 6.1 to before 6.1.3 Fixed in 6.1.3 Patch available GHSA-jmp3-39vp-fwg8
  • wagtail (PyPI) Vendor— Affected 2.0 to before 5.2.6 Fixed in 5.2.6 Patch available GHSA-jmp3-39vp-fwg8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*2.0 to before 5.2.6; 6.0 to before 6.0.6; 6.1 to before 6.1.3Vulnerablewagtail
  • cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:* Versions 2.0 to before 5.2.6; 6.0 to before 6.0.6; 6.1 to before 6.1.3 Vulnerable ·wagtail

Remediation

  • Fix · CNA wagtail (wagtail) Fixed in 5.2.6, 6.0.6, 6.1.3
  • Fix · GHSA-jmp3-39vp-fwg8 wagtail (PyPI) Fixed in 6.0.6 Advisory →
  • Fix · GHSA-jmp3-39vp-fwg8 wagtail (PyPI) Fixed in 6.1.3 Advisory →
  • Fix · GHSA-jmp3-39vp-fwg8 wagtail (PyPI) Fixed in 5.2.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-39317
  2. 2026-10-03 Alias added: GHSA-jmp3-39vp-fwg8

References

Patch 3

Advisory 2

Other 2

  • TI-2026-39163 Wagtail: Reflected XSS in dynamic image URL generator view CVSS 3.1HIGH 7.3
  • TI-2020-08875 Possible XSS attack in Wagtail CVSS 3.1MEDIUM 6.8
  • TI-2023-13342 Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views CVSS 3.1MEDIUM 6.4
  • TI-2026-32180 Wagtail: Improper restriction handling on Documents and Images API CVSS 3.1MEDIUM 5.3
  • TI-2026-22558 Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface CVSS 3.1MEDIUM 6.1
  • TI-2026-22557 Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes CVSS 3.1MEDIUM 6.1
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences