CVE-2024-56374 Potential denial-of-service in IPv6 validation
Medium
Vulnerability Details
Hi IBB :)
in Django i found a potential Dos in IPv6 validation.
Due to Lack of upper bound limit enforcement in strings passed in IPv6 validation(`is_valid_ipv6_address,clean_ipv6_address` methods) ,when a large malformed string with repeatable `:` characters like, `abcd:abcd:abcd:.....` is passed that cause huge resource consumption and slower processing which results in denial-of-service attack .
you can see my cve (CVE-2024-56374) with Security Advisory here:
https://www.djangoproject.com/weblog/2025/jan/14/security-releases/
## Impact
With large malformed string passed for IPv6 validation can perform denial-of-service attack.
Actions
View on HackerOneReport Stats
- Report ID: 2939077
- State: Closed
- Substate: resolved
- Upvotes: 6