CVE-2025-26699: Django: Potential denial-of-service in django.utils.text.wrap()
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
Other sources
The wrap() and :tfilter:wordwrap template filter were subject to a potential denial-of-service attack when used with very long strings.
Affected versions =================
Django main development branch Django 5.2 (currently at beta status) Django 5.1 Django 5.0 Django 4.2
— Red Hat
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:4.2.20-1 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.1.7 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.0.13 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.20 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.1.7 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.0.13 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 4.2.20 - Compensating control
Mitigate CVE-2025-26699 by avoiding use of django.utils.text.wrap() / the wordwrap template filter with very long strings (e.g., limit input length) until upgraded to fixed versions (Django 5.1.7, 5.0.13, or 4.2.20).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26699?
CVE-2025-26699 has a moderate severity level due to its potential for denial-of-service attacks.
How do I fix CVE-2025-26699?
To fix CVE-2025-26699, upgrade Django to version 5.1.7, 5.0.13, or 4.2.20 or later.
Which versions of Django are affected by CVE-2025-26699?
CVE-2025-26699 affects Django versions 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20.
What are the potential impacts of CVE-2025-26699?
The potential impacts of CVE-2025-26699 include service disruptions caused by denial-of-service attacks exploiting long string inputs.
Is there a workaround for CVE-2025-26699?
No specific workarounds have been provided for CVE-2025-26699, so upgrading to a patched version is recommended.