Homepage

Inefficient Regular Expression Complexity The advisory has been revoked - it doesn't affect any version of package python-django20  (opens in a new tab)

Threat Intelligence

EPSS
2.79% (86th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Inefficient Regular Expression Complexity vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL10-PYTHONDJANGO20-9837551
  • published28 Apr 2025
  • disclosed4 Oct 2023
Report a new vulnerability Found a mistake?

Introduced: 4 Oct 2023

CVE-2023-43665  (opens in a new tab)
CWE-1333  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-django20 package and not the python-django20 package as distributed by RHEL.

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

References