Bug 2511110 (CVE-2026-15337)

Summary: CVE-2026-15337 django: Django: Denial-of-service vulnerability due to excessive memory consumption
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, brasmith, cmyers, cochase, dnakabaa, dranck, dschmidt, eglynn, ehelms, ggainey, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, juwatts, jwong, kaycoth, kshier, lbrazdil, lcouzens, lhh, mburns, mdellweg, mgarciac, mhulan, mminar, nmoumoul, omaciel, osousa, pcreech, rbiba, rchan, simaishi, smallamp, sskracic, stcannon, teagle, tmalecek, tpfromme, ttakamiy, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Django. A remote attacker could trigger a denial-of-service (DoS) condition by sending many distinct, very long language codes to the `django.utils.translation.check_for_language()` function. These codes are stored in an in-memory cache, leading to excessive memory consumption. While the memory usage is bounded by configuration settings, this vulnerability could still impact system availability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2512933, 2512934, 2512935    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-04 17:02:40 UTC 
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
`django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Jaeyoung Jang for reporting this issue.