CVE-2024-56374 Potential denial-of-service in IPv6 validation

Disclosed: 2025-02-06 17:57:56 By 0xsaravana To ibb
Medium
Vulnerability Details
Hi IBB :) in Django i found a potential Dos in IPv6 validation. Due to Lack of upper bound limit enforcement in strings passed in IPv6 validation(`is_valid_ipv6_address,clean_ipv6_address` methods) ,when a large malformed string with repeatable `:` characters like, `abcd:abcd:abcd:.....` is passed that cause huge resource consumption and slower processing which results in denial-of-service attack . you can see my cve (CVE-2024-56374) with Security Advisory here: https://www.djangoproject.com/weblog/2025/jan/14/security-releases/ ## Impact With large malformed string passed for IPv6 validation can perform denial-of-service attack.
Actions
View on HackerOne
Report Stats
  • Report ID: 2939077
  • State: Closed
  • Substate: resolved
  • Upvotes: 6
Share this report