CVE-2024-53907: Django strip_tags() DoS Vulnerability

CVE-2024-53907 Overview

CVE-2024-53907 is a denial-of-service vulnerability in the Django web framework. The flaw affects the strip_tags() method and the striptags template filter. Attackers can submit inputs containing large sequences of nested incomplete HTML entities to trigger excessive processing time. The issue impacts Django 5.1 before 5.1.4, Django 5.0 before 5.0.10, and Django 4.2 before 4.2.17. The vulnerability is classified under [CWE-770: Allocation of Resources Without Limits or Throttling]. Remote unauthenticated attackers can exploit this flaw over the network without user interaction, making any Django application that exposes strip_tags() or the striptags filter to user-controlled input a viable target.

Critical Impact

Unauthenticated attackers can exhaust server CPU resources by submitting crafted HTML entity sequences, resulting in application unavailability.

Affected Products

• Django 5.1 versions prior to 5.1.4
• Django 5.0 versions prior to 5.0.10
• Django 4.2 versions prior to 4.2.17

Discovery Timeline

• 2024-12-06 - CVE-2024-53907 published to NVD
• 2025-06-24 - Last updated in NVD database

Technical Details for CVE-2024-53907

Vulnerability Analysis

The vulnerability resides in Django's HTML sanitization utilities. The strip_tags() function in django.utils.html and the corresponding striptags template filter remove HTML tags from input strings. Both routines process HTML entities iteratively to ensure complete sanitization. When supplied with strings containing large sequences of nested incomplete HTML entities, the function enters a computationally expensive processing loop. This algorithmic complexity issue causes the worker process to consume CPU resources disproportionate to the input size. The EPSS score of 1.038% places this vulnerability in the 77th percentile for exploitation likelihood.

Root Cause

The root cause is the absence of input size limits and algorithmic complexity controls in Django's HTML entity normalization logic. The sanitization routine repeatedly scans and rewrites the input string when encountering malformed or incomplete entities. The iterative cleanup pattern lacks bounded execution guarantees, allowing crafted payloads to amplify processing cost beyond linear time complexity.

Attack Vector

An attacker sends an HTTP request containing a payload with deeply nested incomplete HTML entity sequences. The request targets any endpoint that passes user input through strip_tags() or renders a template that applies the striptags filter to attacker-controlled data. Common attack surfaces include comment fields, user profile data, search inputs, and any rendered content. Each malicious request ties up a worker process. Repeated requests rapidly exhaust the available worker pool, denying service to legitimate users.

The vulnerability manifests in Django's strip_tags() implementation. See the Django Security Release Notes for technical details on the patched logic.

Detection Methods for CVE-2024-53907

Indicators of Compromise

• HTTP requests containing payloads with repeated incomplete HTML entity patterns such as &, &#, or nested fragments without terminating semicolons.
• Sudden spikes in CPU utilization on Django application workers correlated with specific request URLs.
• Increased response latency or HTTP 502 and 504 errors from reverse proxies in front of Django applications.
• Worker process timeouts logged by Gunicorn, uWSGI, or similar WSGI servers handling Django traffic.

Detection Strategies

• Inspect web application firewall logs for request bodies and query parameters containing abnormally long sequences of & characters.
• Correlate Django access logs with system metrics to identify slow requests targeting endpoints that invoke strip_tags() or render templates using striptags.
• Deploy runtime monitoring on Python processes to flag CPU-bound calls originating from django.utils.html.

Monitoring Recommendations

• Set request timeout thresholds at the WSGI server and reverse proxy layers to terminate long-running requests.
• Monitor the 95th and 99th percentile response times for endpoints accepting free-form text input.
• Alert on repeated requests from a single source IP that contain entity-heavy payloads exceeding a defined size threshold.

How to Mitigate CVE-2024-53907

Immediate Actions Required

• Upgrade Django to version 5.1.4, 5.0.10, or 4.2.17 depending on the deployed major version branch.
• Audit application code for direct calls to django.utils.html.strip_tags() and templates using the striptags filter on user-controlled input.
• Apply request body size limits at the reverse proxy or load balancer to reject oversized payloads before they reach Django workers.

Patch Information

The Django security team released fixes on December 4, 2024. Apply Django 5.1.4, 5.0.10, or 4.2.17 from the official Python Package Index. See the Django Security Release Notes, the Openwall OSS Security Update, and the Debian LTS Announcement for distribution-specific guidance.

Workarounds

• Truncate or limit the length of user-supplied input before passing it to strip_tags() or rendering it through striptags.
• Replace strip_tags() calls with a bounded sanitizer such as bleach configured with explicit allowlists and input size caps.
• Place a web application firewall rule that blocks request payloads containing more than a defined number of consecutive & characters.

# Upgrade Django to a patched release
pip install --upgrade "Django>=4.2.17,<4.3"   # for 4.2.x deployments
pip install --upgrade "Django>=5.0.10,<5.1"   # for 5.0.x deployments
pip install --upgrade "Django>=5.1.4"         # for 5.1.x deployments

# Verify installed version
python -c "import django; print(django.get_version())"