CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
django.utils.text.Truncator.chars() and Truncator.words() methods (with html=True) and the truncatecharshtml and truncatewordshtml template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.28 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.2.11 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 6.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1285?
CVE-2026-1285 is classified as a potential denial-of-service vulnerability affecting certain HTML methods in Django.
How do I fix CVE-2026-1285?
To fix CVE-2026-1285, update Django to version 4.2.28, 5.2.11, or 6.0.2 or later.
What versions of Django are affected by CVE-2026-1285?
CVE-2026-1285 affects Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
What specific methods in Django are vulnerable in CVE-2026-1285?
The vulnerable methods in Django affected by CVE-2026-1285 are `django.utils.text.Truncator.chars()` and `Truncator.words()` with the `html=True` argument.
How can I verify if my Django application is vulnerable to CVE-2026-1285?
You can verify vulnerability to CVE-2026-1285 by checking if your application uses affected Django versions prior to the specified safe updates.