CVE catalog

CVE-2024-41989

Django vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.20% · Oct 25, 2026

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-djangosid3:5.2.18-1fixed
Debianpython-djangoforky3:5.2.17-2fixed
Debianpython-djangotrixie3:4.2.28-0+deb13u2fixed
Debianpython-djangotrixie-security3:4.2.28-0+deb13u1fixed
Debianpython-djangobookworm3:3.2.25-0+deb12u3fixed
Debianpython-djangobookworm-security3:3.2.25-0+deb12u6fixed
Ubuntupython-djangonoble3:4.2.11-1ubuntu1.2fixed
Ubuntupython-django-docnoble3:4.2.11-1ubuntu1.2fixed
Ubuntupython3-djangonoble3:4.2.11-1ubuntu1.2fixed
Ubuntupython-djangopro1:1.11.4-1ubuntu1vulnerable
Ubuntupython-djangopro1:1.11.6-1ubuntu1vulnerable
Ubuntupython-djangopro1:1.11.9-1ubuntu1vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.1vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.2vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.3vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.4vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.5vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.6vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.7vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.8vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.9vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.10vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.11vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.12vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.13vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.14vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.15vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.16vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.17vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.18vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.19vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.20vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm1vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm2vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm3vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm4vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm5vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm6fixed
Ubuntupython-django20.041:1.11.22-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.6-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.9-2ubuntu1vulnerable
Ubuntupython-django20.042:2.2.10-1vulnerable
Ubuntupython-django20.042:2.2.10-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.11-1vulnerable
Ubuntupython-django20.042:2.2.12-1vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.1vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.2vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.3vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.4vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.5vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.6vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.7vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.8vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.9vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.10vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.11vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.12vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.13vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.14vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.15vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.16vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.17vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.18vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.19vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.20vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.21vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.22vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.23vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.24fixed
Ubuntupython-django22.042:2.2.24-1ubuntu1vulnerable
Ubuntupython-django22.042:3.2.12-2vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.1vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.2vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.3vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.4vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.5vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.6vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.7vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.8vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.9vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.10vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.11vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.12vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.13fixed
Ubuntupython-django24.043:4.2.4-1ubuntu2vulnerable
Ubuntupython-django24.043:4.2.8-1vulnerable
Ubuntupython-django24.043:4.2.9-1vulnerable
Ubuntupython-django24.043:4.2.11-1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.2fixed
Ubuntupython-djangopro1:1.11.4-1ubuntu1vulnerable
Ubuntupython-djangopro1:1.11.6-1ubuntu1vulnerable
Ubuntupython-djangopro1:1.11.9-1ubuntu1vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.1vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.2vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.3vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.4vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.5vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.6vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.7vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.8vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.9vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.10vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.11vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.12vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.13vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.14vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.15vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.16vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.17vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.18vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.19vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.20vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm1vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm2vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm3vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm4vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm5vulnerable
Ubuntupython-djangopro1:1.11.11-1ubuntu1.21+esm6fixed
Ubuntupython-django20.041:1.11.22-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.6-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.9-2ubuntu1vulnerable
Ubuntupython-django20.042:2.2.10-1vulnerable
Ubuntupython-django20.042:2.2.10-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.11-1vulnerable
Ubuntupython-django20.042:2.2.12-1vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.1vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.2vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.3vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.4vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.5vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.6vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.7vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.8vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.9vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.10vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.11vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.12vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.13vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.14vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.15vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.16vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.17vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.18vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.19vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.20vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.21vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.22vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.23vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.24fixed
Ubuntupython-django22.042:2.2.24-1ubuntu1vulnerable
Ubuntupython-django22.042:3.2.12-2vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.1vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.2vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.3vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.4vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.5vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.6vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.7vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.8vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.9vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.10vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.11vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.12vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.13fixed
Ubuntupython-django24.043:4.2.4-1ubuntu2vulnerable
Ubuntupython-django24.043:4.2.8-1vulnerable
Ubuntupython-django24.043:4.2.9-1vulnerable
Ubuntupython-django24.043:4.2.11-1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.2fixed
Opensusepython-Djangotumbleweed5.0.8-1.1fixed
Susepython-Djangolinux enterprise module for package hub 15 sp64.2.11-150600.3.6.1fixed
Opensusepython-Djangoleap 15.64.2.11-150600.3.6.1fixed
Susepython-Djangopackage hub 15 sp52.2.28-bp155.7.15.1fixed
Opensusepython-Djangoleap 15.52.2.28-bp155.7.15.1fixed
Opensusepython-Django4tumbleweed4.2.15-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-djangosourcesid3:4.2.15-1not yet assignedNot reported[1078074]
Debianpython-djangosourceforky3:4.2.15-1not yet assignedNot reported[1078074]
Debianpython-djangosourcetrixie3:4.2.15-1not yet assignedNot reported[1078074]
Debianpython-djangosourcebookworm3:3.2.25-0+deb12u1not yet assignedNot reported[1078074]
Ubuntupython-djangodebnoble3:4.2.11-1ubuntu1.2Not reportedNot reportedNot reported
Ubuntupython-django-docdebnoble3:4.2.11-1ubuntu1.2Not reportedNot reportedNot reported
Ubuntupython3-djangodebnoble3:4.2.11-1ubuntu1.2Not reportedNot reportedNot reported
Ubuntupython-djangodebpro1:1.11.11-1ubuntu1.21+esm6Not reportedUBUNTU-CVE-2024-41989Not reported
Ubuntupython-djangodeb20.042:2.2.12-1ubuntu0.24Not reportedUBUNTU-CVE-2024-41989Not reported
Ubuntupython-djangodeb22.042:3.2.12-2ubuntu1.13Not reportedUBUNTU-CVE-2024-41989Not reported
Ubuntupython-djangodeb24.043:4.2.11-1ubuntu1.2Not reportedUBUNTU-CVE-2024-41989Not reported
Ubuntupython-djangodebpro1:1.11.11-1ubuntu1.21+esm6Not reportedUSN-6946-1Not reported
Ubuntupython-djangodeb20.042:2.2.12-1ubuntu0.24Not reportedUSN-6946-1Not reported
Ubuntupython-djangodeb22.042:3.2.12-2ubuntu1.13Not reportedUSN-6946-1Not reported
Ubuntupython-djangodeb24.043:4.2.11-1ubuntu1.2Not reportedUSN-6946-1Not reported
Opensusepython-Djangorpmtumbleweed5.0.8-1.1Not reportedOPENSUSE-SU-2024:14247-1Not reported
Susepython-Djangorpmlinux enterprise module for package hub 15 sp64.2.11-150600.3.6.1Not reportedSUSE-SU-2024:2816-1Not reported
Opensusepython-Djangorpmleap 15.64.2.11-150600.3.6.1Not reportedSUSE-SU-2024:2816-1Not reported
Susepython-Djangorpmpackage hub 15 sp52.2.28-bp155.7.15.1Not reportedOPENSUSE-SU-2024:0272-1Not reported
Opensusepython-Djangorpmleap 15.52.2.28-bp155.7.15.1Not reportedOPENSUSE-SU-2024:0272-1Not reported
Opensusepython-Django4rpmtumbleweed4.2.15-1.1Not reportedOPENSUSE-SU-2024:14248-1Not reported

[Debian bug #1078074]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • Source package: [python-django]

    Details (6)
    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

  • Source package: [python-django]

    Details (6)
    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

[Debian 13 (Trixie)]

  • Source package: [python-django]

    Details (6)
    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

  • Source package: [python-django]

    Details (6)
    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3:4.2.15-1

      usn · python-django · debian · 13

[openSUSE Tumbleweed]

  • Source package: [python-Django]

    Details (1)
    • 6.0.8-1.1 · noarch · tumbleweed

      Unknown · Fixed: 5.0.8-1.1

      Version impact unknown

      usn · python-Django · opensuse · tumbleweed

  • Source package: [python-Django4]

    Details (1)
    • 4.2.30-5.1 · noarch · tumbleweed

      Unknown · Fixed: 4.2.15-1.1

      Version impact unknown

      usn · python-Django4 · opensuse · tumbleweed

  • Source package: [python-Django]

    Details (1)
    • 6.0.8-1.1 · noarch · tumbleweed

      Unknown · Fixed: 5.0.8-1.1

      Version impact unknown

      usn · python-Django · opensuse · tumbleweed

  • Source package: [python-Django4]

    Details (1)
    • 4.2.30-5.1 · noarch · tumbleweed

      Unknown · Fixed: 4.2.15-1.1

      Version impact unknown

      usn · python-Django4 · opensuse · tumbleweed

Observed:

References