CVE-2026-1285

An attacker can trigger a denial‑of‑service condition by submitting data that contains a large number of unmatched HTML end tags to Django’s truncation utilities when the html flag is enabled. The vulnerability is rooted in resource exhaustion; operations that parse the malformed HTML can consume excessive memory, leading to high CPU usage or crashes. This flaw is categorized as CWE‑407 (Excessive Resource Consumption) and CWE‑770 (Uncontrolled Memory Allocation).

The issue affects the Django framework. Versions 6.0 prior to 6.0.2, 5.2 prior to 5.2.11, and 4.2 prior to 4.2.28 are vulnerable. Older Django series such as 5.0.x, 4.1.x, and 3.2.x were not examined but may also be affected.

The CVSS score is 7.5, indicating a high severity. While the EPSS score is below 1%, meaning that the probability of exploitation has historically been low, the lack of a KEV listing does not mitigate the risk. Exploitation requires an attacker to supply crafted input to an endpoint using Truncator.chars(), Truncator.words(), or the corresponding template filters with html=True. Successfully leveraged, the attacker can cause the target application to consume excessive resources and potentially become unavailable, though remote code execution is not supported.