AIKIDO-2026-793157
Django is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
DjangoTL;DR
Django's check_for_language helper caches each checked language code as a key in an in-memory translation cache. When the set_language view is routed, externally supplied POST data can submit many distinct, very long language codes that are retained as cache keys and consume process memory. This enables a denial-of-service condition, though the impact is bounded by the request size limit and the cache's maximum entry count. The fix rejects language codes longer than 500 characters before the cached lookup.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application explicitly routes the django.views.i18n.set_language view.
Background info
Django is vulnerable to Denial of Service (DoS) in versions 5.2.0 - 5.2.16 and 6.0.0 - 6.0.7.
How to fix this
Upgrade the Django library to the patch version.
Links
Fix Commits
github.com/django/django/commit/224dbc832586ad5cfb0237c2ff30d14baeaddc6fgithub.com/django/django/commit/27137e655e442e81095f1f8f77ff3870d9fdf169github.com/django/django/commit/5b3523d29be25948e1dd90b3863a002f00fc865fgithub.com/django/django/commit/c72a5dbb64d0777f3f471f1be94e8b2ca91e0959Other
docs.djangoproject.com/en/5.2/releases/5.2.17/docs.djangoproject.com/en/dev/releases/security/groups.google.com/g/django-announcedjangoproject.com/weblog/2026/aug/04/security-releases/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant