Internet Bug Bounty · Report #2644244
CVE-2024-41989: Denial-Of-Service vulnerability in the floatformat template filter when input string contains a big exponent in scientific notation
Summary
CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat() The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.
Thanks to Elias Myllymäki for the report.
This issue has severity "moderate" according to the Django security policy.
Full Security Advisory: https://www.djangoproject.com/weblog/2024/aug/06/security-releases/
How it was found
This vulnerability exists in the floatformat input filter when an attacker can pass a string with an "e" character in it to the input filter. This vulnerability takes advantage of the way strings with scientific exponents are converted internally to integers.
Impact
An attacker can cause uncontrolled memory and resource consumption on a vulnerable django server.
(I have attached a screenrecording of the email conversation, the original email as an EML file, the original attachment as a zip file, a screenrecording of the entire email convo, the entire convo as a pdf file and a screenshot from the email convo. My personal email address is ███████ feel free to contact me directly if you have any questions.)