7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1285

CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. django.utils.text.Truncator.chars() and Truncator.words() methods (with html=True) and the truncatechars_html and truncatewords_html template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1285

CVE-2026-1285:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Django	pip	>= 6.0a1, < 6.0.2	6.0.2
Django	pip	>= 5.2a1, < 5.2.11	5.2.11
Django	pip	>= 4.2a1, < 4.2.28	4.2.28

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a potential denial-of-service in Django's text truncation functions when handling HTML content. The root cause lies in the TruncateHTMLParser.handle_endtag method, which is used by Truncator.chars and Truncator.words when their html parameter is set to True. The original code used self.tags.remove(tag) to handle closing HTML tags. This operation has a time complexity of O(n) for a list. An attacker could provide a crafted input with a large number of unmatched closing tags, causing this O(n) operation to be executed repeatedly. This leads to an overall quadratic time complexity (O(n^2)), consuming excessive CPU and resulting in a denial-of-service. The patch addresses this by changing the logic to a Last-In, First-Out (LIFO) stack-based approach. It now only removes a tag if it matches the most recently opened one, which is a constant-time O(1) operation. This change reduces the complexity to linear time, mitigating the DoS vulnerability. The functions Truncator.chars and Truncator.words are the primary user-facing functions that would appear in a runtime profile during exploitation.

Vulnerable functions

TruncateHTMLParser.handle_endtag

django/utils/text.py

The vulnerability is in the `handle_endtag` method of the `TruncateHTMLParser` class. The original implementation used `self.tags.remove(tag)`, which performs a linear scan of the list of open tags. When processing a string with a large number of unmatched HTML closing tags, this results in a quadratic time complexity, leading to a denial-of-service. The patch replaces this with a constant-time LIFO stack operation.

Truncator.chars

django/utils/text.py

This is a public-facing method that, when called with `html=True`, utilizes the vulnerable `TruncateHTMLParser`. An attacker can supply a crafted string to this function to trigger the inefficient algorithmic complexity in `TruncateHTMLParser.handle_endtag`, causing a denial-of-service. A runtime profiler would show this function as an entry point for the exploit.

Truncator.words

django/utils/text.py

Similar to `Truncator.chars`, this is a public-facing method that uses the vulnerable `TruncateHTMLParser` when the `html=True` argument is provided. An attacker can exploit this by passing a crafted string with many unmatched HTML end tags, leading to a denial-of-service. A runtime profiler would show this function as an entry point for the exploit.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.