CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant()
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.translation.getsupportedlanguagevariant() is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Gleb Lizunov for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 5.2.18-r0
Event History
Frequently Asked Questions
Which Django versions are confirmed to be affected and which versions contain the fix?
Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18 are affected. Upgrading to 6.1.2, 6.0.9, or 5.2.18 addresses the issue for those release series.
What must an attacker be able to do to trigger the denial of service?
An attacker must be able to cause get_supported_language_variant() to process many distinct, very long language codes. Those values are retained as keys in an in-memory cache, allowing process memory consumption to grow.
Are unsupported Django release series known to be safe?
No. Earlier unsupported series, including 5.1.x, 5.0.x, and 4.2.x, were not evaluated and may also be affected.