GHSA-jh3w-4vvf-mjgrHighCVSS 7.5

Django has regular expression denial of service vulnerability in EmailValidator/URLValidator

Published
July 3, 2023
Last Modified
November 4, 2025

🔗 CVE IDs covered (1)

CVE-2023-36053 →

📋 Description

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

🎯 Affected products3

  • pip/Django:>= 3.2a1, < 3.2.20
  • pip/Django:>= 4.0a1, < 4.1.10
  • pip/Django:>= 4.2a1, < 4.2.3

🔗 References (19)