CVE-2025-32873: Django: Denial-of-service possibility in strip_tags()
An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.striptags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of striptags().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32873?
The severity of CVE-2025-32873 is classified as high due to the potential for remote code execution.
How do I fix CVE-2025-32873?
To fix CVE-2025-32873, upgrade Django and the python-django package to the latest secure versions available for your distribution.
What versions of Django are affected by CVE-2025-32873?
CVE-2025-32873 affects Django versions 2.2.x up to 2.2.28 and several 3.x versions including 3.2.x prior to 3.2.19.
Is there a workaround for CVE-2025-32873?
While upgrading is strongly recommended, a potential workaround is to restrict access to the vulnerable application components.
What is the impact of CVE-2025-32873 on applications?
CVE-2025-32873 can allow an attacker to execute arbitrary code in the context of the web application, leading to data breaches or system compromise.