CVE-2025-32873

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.striptags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of striptags().

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

Fixed

87175d270aec969d3cad4bad1abf45e07302d795

Introduced

84d09a547fe35e10018ab242602ca76c29ca91a1

Fixed

db5c8a97bb084cee880e678681d63bddecf6d38b

Introduced

Last affected

9e7cc2b628fe8fd3895986af9b7fc9525034c1b0

Database specific

{
    "versions": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.21"
        },
        {
            "introduced": "5.1"
        },
        {
            "fixed": "5.1.9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.2"
        }
    ]
}

Affected versions

1.*

1.0

1.1

1.2

1.2.1

1.3

1.4

1.7a2

4.*

4.2

4.2.1

4.2.10

4.2.11

4.2.12

4.2.13

4.2.14

4.2.15

4.2.16

4.2.17

4.2.18

4.2.19

4.2.2

4.2.20

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.2.8

4.2.9

4.2a1

4.2b1

4.2rc1

5.*

5.1

5.1.1

5.1.2

5.1.3

5.1.4

5.1.5

5.1.6

5.1.7

5.1.8

5.1a1

5.1b1

5.1rc1

5.2

5.2a1

5.2b1

5.2rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32873.json"