Bug 2436340 (CVE-2026-1285)

Summary:	CVE-2026-1285 Django: Django: Denial of Service via crafted HTML inputs
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anthomas, brasmith, caswilli, cmyers, cochase, dnakabaa, dranck, dschmidt, eglynn, ehelms, erezende, ggainey, jjoyce, jlanda, jmitchel, jschluet, juwatts, jwong, kaycoth, kshier, lbrazdil, lcouzens, lhh, mattdavi, mburns, mgarciac, mhulan, mminar, nmoumoul, omaciel, osousa, pbohmill, pcreech, rbiba, rchan, simaishi, smallamp, smcdonal, sskracic, stcannon, teagle, tmalecek, tpfromme, ttakamiy, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Django. A remote attacker can exploit this vulnerability by providing crafted inputs containing a large number of unmatched HTML end tags to the `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (when `html=True`), or through the `truncatechars_html` and `truncatewords_html` template filters. This can lead to a denial-of-service (DoS) condition, making the application unavailable to legitimate users.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2436708, 2436706, 2436709, 2436710, 2436711, 2436718
Bug Blocks:

Description OSIDB Bzimport 2026-02-03 15:01:29 UTC

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Comment 4 errata-xmlrpc 2026-03-06 10:13:51 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:3958 https://access.redhat.com/errata/RHSA-2026:3958

Comment 5 errata-xmlrpc 2026-03-06 10:55:58 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 8
  Red Hat Ansible Automation Platform 2.5 for RHEL 9

Via RHSA-2026:3959 https://access.redhat.com/errata/RHSA-2026:3959

Comment 6 errata-xmlrpc 2026-03-26 20:26:23 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:5970 https://access.redhat.com/errata/RHSA-2026:5970

Comment 7 errata-xmlrpc 2026-03-26 20:26:44 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:5971 https://access.redhat.com/errata/RHSA-2026:5971