onyx --cves cve-2026-15337
CVE-2026-15337
- score
- 0.1
- cvss
- 5.3
- epss
- 0.6%
- published
- 2026-08-04
- kev added
- —
- first seen
Django 5.2 < 5.2.17 and 6.0 < 6.0.8 contain a denial-of-service caused by excessive distinct long language codes cached in django.utils.translation.check_for_language(), letting attackers exhaust process memory, exploit requires access to set_language view.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 7
- https://github.com/django/django/commit/c72a5dbb64d0777f3f471f1be94e8b2ca91e0959
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://github.com/django/django/commit/224dbc832586ad5cfb0237c2ff30d14baeaddc6f
- https://github.com/django/django/commit/27137e655e442e81095f1f8f77ff3870d9fdf169
- https://github.com/django/django/commit/5b3523d29be25948e1dd90b3863a002f00fc865f