Bug 2547370

Summary: CVE-2026-77050 python-django4.2: Denial of service via unbounded caching of long language codes in get_supported_language_variant() [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Vladimir Vasilev <vvasilev>
Component: python-django4.2Assignee: Michel Lind <michel>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: epel10CC: michel, python-packagers-sig
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["61c22acc-72ac-4de8-a714-c1e6291a0bf4"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2544146    

Description Vladimir Vasilev 2026-10-07 10:28:58 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in Django. The django.utils.translation.get_supported_language_variant() function used language codes as keys in an in-memory cache without first limiting their length. A remote, unauthenticated attacker could submit many distinct, very long language codes (for example via the Accept-Language HTTP header processed by Django's locale middleware) to grow this cache and consume excessive process memory over time. The upstream fix rejects or truncates language codes longer than 500 characters before the cached lookup. No confidentiality or integrity impact has been demonstrated.