AIKIDO-2026-10334

TL;DR

Affected versions of django-watchman are vulnerable to a regular expression denial of service (ReDoS) in the parsing of the Authorization HTTP header. The implementation relied on a regex-based parser to process authentication headers for the watchman endpoint. A specially crafted header value could trigger excessive backtracking in the regular expression engine, causing the application to spend excessive CPU time processing the request. An attacker could exploit this behavior by sending malicious requests to the endpoint, potentially leading to resource exhaustion and denial of service. The issue is addressed by replacing the regex-based header parsing with a safer string-splitting approach that avoids polynomial-time processing.