CVE-2025-32873: Django strip_tags() DoS Vulnerability

CVE-2025-32873 Overview

CVE-2025-32873 is a denial-of-service vulnerability affecting the Django web framework. The django.utils.html.strip_tags() function exhibits slow performance when processing inputs containing large sequences of incomplete HTML tags. This algorithmic complexity issue also affects the striptags template filter, which is built on top of strip_tags(). Attackers can exploit this vulnerability by sending specially crafted input to web applications using these functions, potentially causing service degradation or unavailability.

Critical Impact

Applications using strip_tags() or the striptags template filter may experience significant performance degradation when processing malicious input containing large sequences of incomplete HTML tags, leading to denial of service conditions.

Affected Products

• Django 4.2 before 4.2.21
• Django 5.1 before 5.1.9
• Django 5.2 before 5.2.1

Discovery Timeline

• May 7, 2025 - Django releases security patch
• May 8, 2025 - CVE-2025-32873 published to NVD
• September 2, 2025 - Last updated in NVD database

Technical Details for CVE-2025-32873

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The strip_tags() function in Django's HTML utilities is designed to remove HTML tags from text content, providing a security mechanism to sanitize user input. However, the implementation contains an algorithmic inefficiency that manifests when parsing malformed HTML containing incomplete tag sequences.

When the function encounters input with many unclosed or incomplete HTML tags, the parsing algorithm enters a computationally expensive state. This creates an asymmetric resource consumption scenario where a relatively small malicious payload can consume disproportionate server resources, making it an attractive vector for denial-of-service attacks.

The vulnerability extends to the striptags template filter, as it relies on the underlying strip_tags() function. This means any Django template using {{ variable|striptags }} syntax is potentially vulnerable if the variable contains user-controlled content.

Root Cause

The root cause lies in the algorithmic handling of incomplete HTML tag sequences within strip_tags(). When processing strings with numerous incomplete tags (such as many opening angle brackets without corresponding closing brackets), the function's internal state machine operates inefficiently, resulting in exponential or polynomial time complexity relative to input size. This is a classic example of algorithmic complexity vulnerability where the worst-case performance significantly exceeds average-case performance.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker would identify entry points where user input is processed by strip_tags() or rendered through templates using the striptags filter. By submitting carefully crafted payloads containing large sequences of incomplete HTML tags, an attacker can force the server to expend excessive CPU cycles processing the malicious input.

Common attack surfaces include:

• Form fields where HTML is stripped before storage or display
• API endpoints that sanitize HTML content
• Comment systems or user-generated content platforms
• Any template rendering user input with the striptags filter

The attack does not require user interaction and can be automated to overwhelm server resources through repeated requests.

Detection Methods for CVE-2025-32873

Indicators of Compromise

• Sudden increases in CPU utilization on Django application servers
• HTTP requests with unusually large payloads containing repetitive incomplete HTML patterns (e.g., sequences of < characters)
• Application timeouts or slow response times correlated with specific request patterns
• Log entries showing extended request processing times for specific endpoints

Detection Strategies

• Implement request rate limiting and payload size validation at the web application firewall level
• Monitor application performance metrics for anomalous CPU spikes during request processing
• Audit code for usage of strip_tags() and striptags template filter with user-controlled input
• Deploy application performance monitoring (APM) to identify slow transaction patterns

Monitoring Recommendations

• Configure alerts for CPU utilization thresholds on Django application servers
• Monitor request processing time distributions and alert on statistical outliers
• Track request payload sizes and flag requests with unusual character patterns
• Implement logging around strip_tags() calls to capture processing duration

How to Mitigate CVE-2025-32873

Immediate Actions Required

• Upgrade Django to version 4.2.21, 5.1.9, or 5.2.1 depending on your current version branch
• Review application code to identify all uses of strip_tags() and striptags template filter
• Implement input validation to limit the size of content processed by these functions
• Consider temporary workarounds if immediate patching is not possible

Patch Information

Django has released security patches addressing this vulnerability. Affected users should upgrade to the following versions:

• Django 4.2.x users: Upgrade to Django 4.2.21 or later
• Django 5.1.x users: Upgrade to Django 5.1.9 or later
• Django 5.2.x users: Upgrade to Django 5.2.1 or later

Refer to the Django Security Releases announcement for complete patch details and upgrade instructions. Additional technical information is available through the Django Security Release Notes.

Workarounds

• Implement strict input length validation before calling strip_tags() to limit maximum input size
• Use alternative HTML sanitization libraries such as bleach or html-sanitizer that may not share this vulnerability
• Deploy web application firewall rules to block requests containing suspicious patterns of incomplete HTML tags
• Implement request timeout configurations to prevent long-running requests from consuming resources indefinitely

# Upgrade Django to patched version
pip install --upgrade Django>=4.2.21  # For Django 4.2.x users
pip install --upgrade Django>=5.1.9   # For Django 5.1.x users
pip install --upgrade Django>=5.2.1   # For Django 5.2.x users

# Verify installed version
python -c "import django; print(django.VERSION)"