CVE-2024-39317: 
Python vulnerability analysis and mitigation

CVE-2024-39317 affects Wagtail, an open source content management system built on Django. The vulnerability was discovered in Wagtail's parse_query_string function, which could result in a denial of service when processing specially crafted inputs. The issue affects all versions from Wagtail 2.0 up to (excluding) 5.2.6, versions 6.0 to (excluding) 6.0.6, and versions 6.1 to (excluding) 6.1.3 (GitHub Advisory).

The vulnerability stems from inefficient regular expression complexity (CWE-1333) in the parse_query_string function. When parsing sufficiently long strings of characters without a space, the function would take an unexpectedly large amount of time to process. The issue has a CVSS v3.1 base score of 6.5 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory).

The vulnerability can lead to a denial of service condition when processing specially crafted search queries. In a default Wagtail installation, the vulnerability can be exploited by any Wagtail admin user but cannot be exploited by end users. However, if a Wagtail site has a custom search implementation using parse_query_string, it may be exploitable by other users, including unauthenticated users (GitHub Advisory).

The vulnerability requires low attack complexity and can be exploited remotely. It requires low privileges (authenticated admin user in default installations) and no user interaction for successful exploitation (GitHub Advisory).

Patched versions have been released as Wagtail 5.2.6, 6.0.6, and 6.1.3. For sites unable to upgrade immediately, a workaround is available by limiting the length of search terms passed to parse_query_string. A limit of 1000 characters has been shown to be effective without triggering the vulnerability. However, this workaround is not available for Wagtail admin usage (GitHub Advisory).