AIKIDO-2026-793157
Django is vulnerable to Denial of Service (DoS)
53
CVE Score
Medium
Denial of Service (DoS)
TL;DR
Django's check_for_language helper caches each checked language code as a key in an in-memory translation cache. When the set_language view is routed, externally supplied POST data can submit many distinct, very long language codes that are retained as cache keys and consume process memory. This enables a denial-of-service condition, though the impact is bounded by the request size limit and the cache's maximum entry count. The fix rejects language codes longer than 500 characters before the cached lookup.
How do I fix this?
Upgrade the Django library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application explicitly routes the django.views.i18n.set_language view.
Package
Versions
5.2.0 - 5.2.16
Fixed in 5.2.176.0.0 - 6.0.7
Fixed in 6.0.8Background info
Django is vulnerable to Denial of Service (DoS) in versions 5.2.0 - 5.2.16 and 6.0.0 - 6.0.7.
Links
Fix Commits
github.com/django/django/commit/224dbc832586ad5cfb0237c2ff30d14baeaddc6fgithub.com/django/django/commit/27137e655e442e81095f1f8f77ff3870d9fdf169github.com/django/django/commit/5b3523d29be25948e1dd90b3863a002f00fc865fgithub.com/django/django/commit/c72a5dbb64d0777f3f471f1be94e8b2ca91e0959Other
docs.djangoproject.com/en/5.2/releases/5.2.17/docs.djangoproject.com/en/dev/releases/security/groups.google.com/g/django-announcedjangoproject.com/weblog/2026/aug/04/security-releases/
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.