-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the trim_punctuation method's handling of wrapping punctuation (like brackets). The GitHub patch shows this method was rewritten to use a CountsDict for efficient counting, and tests were added for 100,000-bracket inputs. The CWE-130 (Improper Length Handling) and CWE-770 (Unlimited Allocation) align with the original code's O(n²) processing of nested brackets. The commit message explicitly cites urlize/urlizetrunc as the attack vectors, and the vulnerability description confirms their role in the DoS scenario.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 4.2, < 4.2.14 | 4.2.14 |
| Django | pip | >= 5.0, < 5.0.7 | 5.0.7 |