CVE-2024-56374: Django has a potential denial-of-service vulnerability in IPv6 validation
(updated )
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)
References
- docs.djangoproject.com/en/dev/releases/security
- github.com/advisories/GHSA-qcgg-j2x8-h9g8
- github.com/django/django
- github.com/django/django/commit/4806731e58f3e8700a3c802e77899d54ac6021fe
- github.com/django/django/commit/ad866a1ca3e7d60da888d25d27e46a8adb2ed36e
- github.com/django/django/commit/ca2be7724e1244a4cb723de40a070f873c6e94bf
- github.com/django/django/commit/e8d4a2005955dcf962193600b53bf461b190b455
- github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-1.yaml
- groups.google.com/g/django-announce
- lists.debian.org/debian-lts-announce/2025/01/msg00024.html
- nvd.nist.gov/vuln/detail/CVE-2024-56374
- www.djangoproject.com/weblog/2025/jan/14/security-releases
Code Behaviors & Features
Detect and mitigate CVE-2024-56374 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →