Django ReDoS in validators.URLValidator

ÉLEVÉE 7.8CVE-2015-5145 · GHSA-cqf7-ff9h-7967 · PYSEC-2015-21 · Published 14/07/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
django PyPI	`≥ 1.8, < 1.8.3≥ 1.8a1, < 1.8.3`	`1.8.3`
django djangoproject	`= 1.8.0= 1.8.1= 1.8.2`	No fix yet

Description

validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.

NVD description

validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2015-5145 · ADVISORY
django/django commit 8f9a4d3 · WEB
django/django · PACKAGE
django/django · WEB
pypa/advisory-database · WEB
security.gentoo.org/glsa/201510-06 · WEB
web.archive.org/web/20150924150801/http://www.securitytracker.com/id/1032820 · WEB
web.archive.org/web/20170526042302/http://www.securityfocus.com/bid/75691 · WEB
djangoproject.com/weblog/2015/jul/08/security-releases · WEB
securityfocus.com/bid/75691
securitytracker.com/id/1032820
djangoproject.com/weblog/2015/jul/08/security-releases · Vendor Advisory
GitHub Advisory GHSA-cqf7-ff9h-7967 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free