Bug 2364980 (CVE-2025-32873)

Summary: CVE-2025-32873 django: Django StripTags Denial of Service
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, brking, davidn, dranck, eglynn, ehelms, ggainey, gtanzill, haoli, hkataria, jajackso, jcammara, jjoyce, jmitchel, jneedle, jschluet, juwatts, kegrant, koliveir, kshier, lhh, lsvaty, mabashia, mburns, mgarciac, mhulan, mminar, nmoumoul, osousa, pbraun, pcreech, pgrist, rbiba, rchan, relrod, shvarugh, simaishi, smallamp, smcdonal, sskracic, stcannon, teagle, tfister, thavo, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Django. This vulnerability allows denial of service via processing inputs containing large sequences of incomplete HTML tags.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2365039, 2365040, 2365041, 2365042, 2365043, 2365044, 2365045, 2365046, 2365047    
Bug Blocks:    

Description OSIDB Bzimport 2025-05-08 04:01:29 UTC 
An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().