CVE-2026-15337: Potential denial-of-service vulnerability in check_for_language()
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage() is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the django.views.i18n.setlanguage() view, which is not routed by default. The consumed memory is bounded, since request data is limited by the DATAUPLOADMAXMEMORYSIZE setting (default 2.5 MB) and the cache holds a fixed maximum number of entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jaeyoung Jang for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.2.17 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.0.8 - Configuration
Ensure request data size is limited by DATA_UPLOAD_MAX_MEMORY_SIZE (default 2.5 MB) to bound resource consumption during potential denial-of-service via set_language/check_for_language().
Django DATA_UPLOAD_MAX_MEMORY_SIZE = 2.5 MB (default) - Configuration
Keep django.views.i18n.set_language() unexposed (do not route it) since it is the path through which check_for_language() is reached.
Django (translation/language switching) django.views.i18n.set_language routing = not routed by default
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15337?
The severity of CVE-2026-15337 is categorized as medium with a score of 5.3.
What type of vulnerability is CVE-2026-15337?
CVE-2026-15337 is a potential denial-of-service vulnerability affecting certain versions of Django.
Who is affected by CVE-2026-15337?
CVE-2026-15337 affects Django versions prior to 5.2.17 and 6.0 prior to 6.0.8.
How do I fix CVE-2026-15337?
To mitigate CVE-2026-15337, upgrade Django to version 5.2.17 or 6.0.8 or later.
What is the impact of CVE-2026-15337?
CVE-2026-15337 may result in excessive memory consumption leading to a denial-of-service condition.