CVE-2025-32873
Fixed in a distro release EPSS 14%CVSS 5.3
An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().
Products: djangoproject django
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 4.2.21 |
| PyPI | django | 5.1.9 |
| PyPI | django | 5.2.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | python-django | 5.1.9-1 |
| Chainguard | awx | 24.6.1-r6 |
| Chainguard | grafana-oncall | 1.16.1-r0 |
| Chainguard | grafana-oncall-compat | 1.16.1-r0 |
| Debian 11 | python-django | 2:2.2.28-1~deb11u7 |
| Debian 12 | python-django | 3:3.2.25-0+deb12u1 |
| Debian 13 | python-django | 3:4.2.21-1 |
| Debian 14 | python-django | 3:4.2.21-1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | python-Django | 4.2.11-150600.3.21.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | python-Django | 4.2.11-150600.3.21.1 |
| Ubuntu 20.04 LTS | python-django | 2:2.2.12-1ubuntu0.29 |
| Ubuntu 22.04 LTS | python-django | 2:3.2.12-2ubuntu1.18 |
| Ubuntu 24.04 LTS | python-django | 3:4.2.11-1ubuntu1.7 |
| Ubuntu 25.10 | python-django | 3:4.2.18-1ubuntu1.1 |
| Ubuntu Pro 14.04 LTS | python-django | no fix |
| Ubuntu Pro 16.04 LTS | python-django | no fix |
| Ubuntu Pro 18.04 LTS | python-django | 1:1.11.11-1ubuntu1.21+esm11 |
| Wolfi | grafana-oncall | 1.16.1-r0 |
| Wolfi | grafana-oncall-compat | 1.16.1-r0 |
| openSUSE Leap 15.6 | python-Django | 4.2.11-150600.3.21.1 |
| openSUSE Tumbleweed | python-Django | 5.2.1-1.1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.21-1.1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 |