Django ReDoS in validators.URLValidator

published 2015-07-14 11 y ago modified 2026-06-17 4 mo ago also GHSA-cqf7-ff9h-7967 , PYSEC-2015-21 , EUVD-2015-0010

cvss: 7.5; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: 3.0%; EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.

Patch / fix

fixed in 1 distros 1 links 1

pypi django 1.8.3

python-Django5 openSUSE Tumbleweed 5.2.16-1.1
python-Django openSUSE Tumbleweed 5.2.16-1.1
python-Django4 openSUSE Tumbleweed 4.2.30-4.1
python-Django6 openSUSE Tumbleweed 6.0-1.1
python-Django4 openSUSE Tumbleweed 4.2.14-1.1
python-Django openSUSE Tumbleweed 1.9.12-1.1
python-Django openSUSE Tumbleweed 3.2.7-2.3
python-Django openSUSE Tumbleweed 4.2.11-2.1

opensuse advisories openSUSE-SU-2026:11270-1 openSUSE-SU-2026:11248-1 openSUSE-SU-2026:11235-1 openSUSE-SU-2026:10005-1 openSUSE-SU-2024:14208-1 openSUSE-SU-2024:10066-1

github.com/django/django@8f9a4d3 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-5145 updated 2025-11-21 cvss 5.0

Django: DoS via incorrect URL validation

Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) python-django Red Hat Enterprise Linux OpenStack Platform 6 (Juno) python-django Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) python-django, python-django-bash-completion Red Hat Subscription Asset Manager Django
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.98% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.8	AV:N/AC:L/Au:N/C:N/I:N/A:C
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	django	>=1.8a1, <1.8.3 >=1.8, <1.8.3	1.8.3

Classification

Weakness

CWE-399 Resource Management Errors
CWE-1333 Inefficient Regular Expression Complexity
CWE-400 Uncontrolled Resource Consumption

Technology feeds

Django rss critical rss

References

github.com /django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c
web
security.gentoo.org /glsa/201510-06
vendor-advisory, web, advisory
djangoproject.com /weblog/2015/jul/08/security-releases/
vendor-advisory, article
securityfocus.com /bid/75691
vdb-entry, web
securitytracker.com /id/1032820
vdb-entry, web
nvd.nist.gov /vuln/detail/CVE-2015-5145
advisory
github.com /django/django
package
github.com /django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.8.3.txt#L63-L68
web
github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-21.yaml
web
web.archive.org /web/20150924150801/http://www.securitytracker.com/id/1032820
web
web.archive.org /web/20170526042302/http://www.securityfocus.com/bid/75691
web
djangoproject.com /weblog/2015/jul/08/security-releases
web
github.com /advisories/GHSA-cqf7-ff9h-7967
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary