id: PYSEC-2025-37
modified: 2025-05-08T05:23:16.210893Z
published: 2025-05-08T04:17:18Z
aliases:
- CVE-2025-32873
- GHSA-8j24-cjrq-gr2m
details: An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and
  5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a
  potential denial-of-service (slow performance) when processing inputs containing
  large sequences of incomplete HTML tags. The template filter striptags is also vulnerable,
  because it is built on top of strip_tags().
affected:
- package:
    ecosystem: PyPI
    name: django
    purl: pkg:pypi/django
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "4.2"
    - fixed: 4.2.21
    - introduced: "5.1"
    - fixed: 5.1.9
    - introduced: "5.2"
    - fixed: 5.2.1
  versions:
  - "4.2"
  - 4.2.1
  - 4.2.10
  - 4.2.11
  - 4.2.12
  - 4.2.13
  - 4.2.14
  - 4.2.15
  - 4.2.16
  - 4.2.17
  - 4.2.18
  - 4.2.19
  - 4.2.2
  - 4.2.20
  - 4.2.3
  - 4.2.4
  - 4.2.5
  - 4.2.6
  - 4.2.7
  - 4.2.8
  - 4.2.9
  - "5.1"
  - 5.1.1
  - 5.1.2
  - 5.1.3
  - 5.1.4
  - 5.1.5
  - 5.1.6
  - 5.1.7
  - 5.1.8
  - "5.2"
references:
- type: ARTICLE
  url: https://www.djangoproject.com/weblog/2025/may/07/security-releases/
- type: WEB
  url: https://docs.djangoproject.com/en/dev/releases/security/
- type: WEB
  url: https://groups.google.com/g/django-announce
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2025/05/07/1
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8j24-cjrq-gr2m