CVE-2024-27351

score

<0.1

cvss

5.3

epss

1.9%

published

2024-03-15

kev added

—

first seen

2026-10-21

Django 3.2 < 3.2.25, 4.2 < 4.2.11, and 5.0 < 5.0.3 contain a regular expression denial-of-service caused by incomplete fix for CVE-2019-14232 and CVE-2023-43665 in django.utils.text.Truncator.words() with html=True and the truncatewords_html template filter, letting attackers craft strings to cause denial of service, exploit requires crafted input string.