CVE-2026-1285: 
Django vulnerability analysis and mitigation

CVE-2026-1285 is a denial-of-service vulnerability in Django's HTML truncation utilities, specifically affecting django.utils.text.Truncator.chars() and Truncator.words() methods (when called with html=True), as well as the truncatechars_html and truncatewords_html template filters. It was disclosed on February 3, 2026, and affects Django versions 4.2 before 4.2.28, 5.2 before 5.2.11, and 6.0 before 6.0.2; earlier unsupported series (3.2.x, 4.1.x, 5.0.x) were not evaluated but may also be affected. The vulnerability was reported by Seokchan Yoon. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is inefficient algorithmic complexity (CWE-407) and allocation of resources without limits or throttling (CWE-770) in Django's HTML-aware text truncation logic. When processing input containing a large number of unmatched HTML end tags, the truncation algorithm exhibits worst-case computational behavior, consuming excessive CPU or memory resources. The vulnerability is remotely exploitable with no authentication, no user interaction, and low attack complexity — an attacker simply needs to supply crafted input to any application endpoint that passes user-controlled data through the affected truncation functions or template filters. The fix is tracked in the Django source repository (Django Changeset, GitHub Advisory).

Successful exploitation causes a denial-of-service condition by exhausting server-side processing resources when the vulnerable truncation methods handle maliciously crafted HTML input. There is no impact on confidentiality or data integrity — the sole consequence is availability degradation, potentially rendering the affected Django application unresponsive. Applications that expose user-controlled content to truncatechars_html, truncatewords_html, or the underlying Truncator methods with html=True are at risk, and the impact is scoped to the vulnerable system without lateral movement potential (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-1285. The EPSS score is approximately 0.042% (23rd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been identified (GitHub Advisory).

1. Identify target: Locate a Django application (versions 4.2.x < 4.2.28, 5.2.x < 5.2.11, or 6.0.x < 6.0.2) that accepts user-supplied input and passes it through truncatechars_html, truncatewords_html, or Truncator.chars()/Truncator.words() with html=True.
2. Craft malicious payload: Construct an input string containing a very large number of unmatched HTML end tags (e.g., thousands of </div>, </span>, or similar closing tags with no corresponding opening tags).
3. Submit payload: Send the crafted input via any application form field, API parameter, or URL component that feeds into the vulnerable truncation logic — no authentication is required if the endpoint is publicly accessible.
4. Trigger DoS: The server's truncation algorithm enters worst-case processing, consuming excessive CPU cycles and potentially causing the Django worker process to become unresponsive or time out, degrading service availability for legitimate users (GitHub Advisory, Red Hat Bugzilla).

• Logs: Django application logs or web server access logs showing repeated requests to endpoints that render truncated HTML content, particularly with unusually large or malformed input payloads.
• Process: Django worker processes (e.g., gunicorn, uWSGI) exhibiting sustained high CPU usage or hanging/timing out when processing specific requests.
• Network: Repeated HTTP requests from the same source IP targeting form fields or API parameters that accept text content, with request bodies containing large numbers of HTML closing tags (e.g., </div></div></div>...).
• Application: Increased rate of HTTP 500 errors or request timeouts from the Django application coinciding with the above network patterns.

Django has released patched versions addressing this vulnerability: 4.2.28, 5.2.11, and 6.0.2. All users running affected versions should upgrade immediately. No official configuration-based workaround is provided; however, as an interim measure, applications can sanitize or limit the length of user-supplied input before passing it to the affected truncation functions, or avoid using html=True with untrusted input. Red Hat has issued errata for affected products including Ansible Automation Platform (RHSA-2026:3958, RHSA-2026:3959) and Red Hat Satellite (RHSA-2026:5970, RHSA-2026:5971) (Django Security Releases, Red Hat Bugzilla).

The Django project published a security release blog post on February 3, 2026, crediting Seokchan Yoon for responsible disclosure and urging users to upgrade promptly (Django Security Releases). The Django security team also published a follow-up post on February 4, 2026, discussing recent trends observed by the security team (Django Security Blog). Security news outlets including GBHackers, CyberSecurityNews, and SecurityOnline covered the release, noting the DoS risk alongside other vulnerabilities patched in the same release cycle. Ubuntu, Debian, Fedora, SUSE, and Mageia all issued downstream advisories, reflecting broad ecosystem attention to the patch (Ubuntu Advisory).