Bug 2544146 (CVE-2026-77050)

Summary: CVE-2026-77050 django: Denial of service via unbounded caching of long language codes in get_supported_language_variant()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, brasmith, cmyers, cochase, dnakabaa, dranck, dschmidt, eglynn, ehelms, ggainey, ikhan, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, juwatts, jwong, kaycoth, kshier, lbrazdil, lcouzens, lhh, mburns, mdellweg, mgarciac, mhulan, mminar, nmoumoul, omaciel, osousa, pcreech, rbiba, rbobbitt, rchan, security-response-team, simaishi, smallamp, sskracic, stcannon, tmalecek, tpfromme, ttakamiy, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Django. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by submitting requests containing numerous distinct, excessively long language codes. Because Django's translation component caches these codes in memory without length restrictions, continuous requests can exhaust available server memory and degrade application availability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2547370, 2547369, 2547371    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-30 17:20:29 UTC 
A flaw was found in Django. The django.utils.translation.get_supported_language_variant() function used language codes as keys in an in-memory cache without first limiting their length. A remote, unauthenticated attacker could submit many distinct, very long language codes (for example via the Accept-Language HTTP header processed by Django's locale middleware) to grow this cache and consume excessive process memory over time. The upstream fix rejects or truncates language codes longer than 500 characters before the cached lookup. No confidentiality or integrity impact has been demonstrated.