An issue in Django’s translation utility allows an attacker to trigger a denial‑of‑service by passing many distinct, very long language codes. Each code is stored as a key in an in‑memory cache, and the cache grows without bound, consuming process memory until the application stalls or crashes. The weakness is an uncontrolled resource consumption flaw (CWE‑770) and an uncontrolled memory allocation flaw (CWE‑789).

The vulnerability affects Django versions 6.1 through 6.1.1, 6.0 through 6.0.8, and 5.2 through 5.2.17, as well as earlier unsupported series 5.1.x, 5.0.x, and 4.2.x. Upgrade to at least Django 6.1.2, 6.0.9, or 5.2.18 to remediate the defect.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. The likely attack vector is an application that processes user‑supplied language codes; an adversary can craft inputs that create many unique, lengthy codes to exhaust memory.