CVE-2024-56374: Denial-of-service vulnerability in IPv6 validation
Medium
I
Internet Bug Bounty
Submitted None
Actions:
Reported by
sav_
Vulnerability Details
Technical details and impact analysis
Hi IBB Team, :)
I discovered a vulnerability in Django related to `IPv6` validation that could potentially lead to a denial-of-service attack. You can find the details of my report and the assigned (CVE-2024-42005) at the following links:
* https://www.djangoproject.com/weblog/2025/jan/14/security-releases/
* https://github.com/django/django/commit/ca2be7724e1244a4cb723de40a070f873c6e94bf#diff-dde021d7427efcb4de60b971a1dbcafb0aa3732f263572be835a311d8be20d96R10
## Impact
Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions `clean_ipv6_address and is_valid_ipv6_address` were vulnerable, as was the `django.forms.GenericIPAddressField` form field, which has now been updated to define a max_length of 39 characters.
Related CVEs
Associated Common Vulnerabilities and Exposures
CVE-2024-42005
CRITICAL
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$2162.00