Loading HuntDB...

CVE-2024-56374: Denial-of-service vulnerability in IPv6 validation

Medium
I
Internet Bug Bounty
Submitted None
Reported by sav_

Vulnerability Details

Technical details and impact analysis

Hi IBB Team, :) I discovered a vulnerability in Django related to `IPv6` validation that could potentially lead to a denial-of-service attack. You can find the details of my report and the assigned (CVE-2024-42005) at the following links: * https://www.djangoproject.com/weblog/2025/jan/14/security-releases/ * https://github.com/django/django/commit/ca2be7724e1244a4cb723de40a070f873c6e94bf#diff-dde021d7427efcb4de60b971a1dbcafb0aa3732f263572be835a311d8be20d96R10 ## Impact Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions `clean_ipv6_address and is_valid_ipv6_address` were vulnerable, as was the `django.forms.GenericIPAddressField` form field, which has now been updated to define a max_length of 39 characters.

Related CVEs

Associated Common Vulnerabilities and Exposures

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$2162.00

Submitted