CVE-2026-77050

Publié : 6 octobre 2026

Modifié : 6 octobre 2026

Score CVSS

5.3

MEDIUM

Description détaillée

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Gleb Lizunov for reporting this issue.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Références et Patchs

https://docs.djangoproject.com/en/dev/releases/security/https://github.com/django/django/commit/02a69e3791e3df23d45ea4ea7e7fc489f0eef2be https://github.com/django/django/commit/3d32ee80ae52745d686bf94d3555000ddf073267 https://github.com/django/django/commit/7e878b0f8bd42260903e6a0d38996a93b0474a0b https://github.com/django/django/commit/c88b304cc2d90fc37d3bd1f5f3829706fa6c13bc https://groups.google.com/g/django-announce https://www.djangoproject.com/weblog/2026/oct/06/security-releases/

Dernières Vulnérabilités

CVE-2026-95153

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints

VOIR DÉTAILS

CVE-2026-95140

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart request

VOIR DÉTAILS

CVE-2026-106219

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

VOIR DÉTAILS