CVE-2024-41989: Django floatformat Template Filter DoS

CVE-2024-41989 Overview

CVE-2024-41989 is a denial-of-service vulnerability in the Django web framework. The floatformat template filter consumes excessive memory when processing a string representation of a number in scientific notation with a large exponent. An attacker who can supply input rendered by this filter can trigger memory exhaustion on the application server.

The issue affects Django 5.0 before 5.0.8 and Django 4.2 before 4.2.15. It is classified under [CWE-400] (Uncontrolled Resource Consumption) and is remotely exploitable without authentication or user interaction. The Django security team released patched versions on August 6, 2024.

Critical Impact
Unauthenticated attackers can exhaust server memory by submitting crafted scientific-notation values to any view that passes user input through the floatformat template filter.

Affected Products

Django 5.0 versions prior to 5.0.8
Django 4.2 versions prior to 4.2.15
NetApp products bundling vulnerable Django releases (see NTAP-20240905-0007)

Discovery Timeline

2024-08-06 - Django project releases security advisory and patched versions
2024-08-07 - CVE-2024-41989 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41989

Vulnerability Analysis

The vulnerability resides in Django's floatformat template filter, which formats numeric values for display in templates. When the filter receives a string representation of a number in scientific notation containing a large exponent, internal numeric handling allocates memory proportional to the magnitude expressed by the exponent rather than the size of the input string.

A short input such as a few bytes can therefore represent a value requiring gigabytes of memory to materialize. Repeated requests against vulnerable endpoints can exhaust available memory and cause the Python worker process to crash or trigger out-of-memory conditions across the host.

Django advisories list this as a denial-of-service issue with no impact on confidentiality or integrity. The CWE-400 classification reflects uncontrolled resource consumption rather than a memory-safety defect.

Root Cause

The floatformat filter relies on Python's decimal.Decimal for precision formatting. Passing a string like "1e1000000000" causes Decimal operations within the filter to allocate large internal representations during quantization and rounding. Django's pre-patch code did not bound the exponent magnitude before performing these operations.

Attack Vector

Exploitation requires that user-controlled input reaches a template expression using {{ value|floatformat }} or a variant such as {{ value|floatformat:2 }}. Any form field, query parameter, JSON body field, or stored value rendered through this filter is a candidate. The attacker submits a value such as 1e2147483647 and the rendering worker attempts to allocate memory sufficient to represent that magnitude.

The vulnerability is network-reachable, requires no privileges, and needs no user interaction, which aligns with the published attack characteristics. See the Django Weblog Security Releases for the official analysis.

Detection Methods for CVE-2024-41989

Indicators of Compromise

Sudden memory pressure or out-of-memory kills on Django application workers (gunicorn, uwsgi, runserver) without a corresponding traffic spike
HTTP request bodies or query strings containing scientific-notation values with very large exponents, for example patterns matching [0-9]+e[0-9]{6,}
Repeated 500 errors or worker restarts originating from views that render numeric user input through templates

Detection Strategies

Inspect web server and WAF logs for request parameters matching scientific notation with abnormally large exponents
Correlate worker process restarts and memory-exhaustion events with the request immediately preceding the crash
Audit Django templates for usage of floatformat and map each occurrence to the upstream input source

Monitoring Recommendations

Set per-worker memory limits in gunicorn or uwsgi and alert when limits are hit
Forward Django and reverse-proxy logs to a centralized analytics platform and alert on bursts of 5xx responses against template-rendering endpoints
Add WAF rules that reject query parameters and form fields containing exponents above a defined threshold

How to Mitigate CVE-2024-41989

Immediate Actions Required

Upgrade Django to 5.0.8 or 4.2.15 on all production and staging environments
Inventory all templates and serializers that invoke the floatformat filter and review their input sources
Apply temporary input validation at the view or form layer to reject numeric strings with oversized exponents until the upgrade completes

Patch Information

The Django project addressed the issue in versions 5.0.8 and 4.2.15, released on August 6, 2024. Patches add bounds on the exponent magnitude accepted by floatformat before performing decimal operations. Full release notes are available in the Django Security Release Documentation and the NetApp Security Advisory NTAP-20240905-0007 for bundled distributions.

Workarounds

Validate numeric input in Django forms or serializers using DecimalField or FloatField with explicit max_digits and range constraints
Strip or reject request parameters matching scientific notation with large exponents at the reverse proxy or WAF layer
Avoid passing untrusted strings directly to floatformat; coerce values to bounded numeric types before rendering

bash

# Upgrade Django to a patched release
pip install --upgrade "Django>=4.2.15,<5.0"   # for 4.2.x deployments
pip install --upgrade "Django>=5.0.8"         # for 5.0.x deployments

# Verify installed version
python -c "import django; print(django.get_version())"