Internet Bug Bounty · Report #2939077

CVE-2024-56374 Potential denial-of-service in IPv6 validation

Validstatus

mediumseverity

29upvotes

6 Feb 2025disclosed

Summary

CVE-2024-56374: Potential denial-of-service vulnerability in IPv6 validation

Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address were vulnerable, as was the django.forms.GenericIPAddressField form field, which has now been updated to define a max_length of 39 characters.

The django.db.models.GenericIPAddressField model field was not affected.

How it was found

Hi IBB :) in Django i found a potential Dos in IPv6 validation. Due to Lack of upper bound limit enforcement in strings passed in IPv6 validation(is_valid_ipv6_address,clean_ipv6_address methods) ,when a large malformed string with repeatable : characters like, abcd:abcd:abcd:..... is passed that cause huge resource consumption and slower processing which results in denial-of-service attack .

you can see my cve (CVE-2024-56374) with Security Advisory here: https://www.djangoproject.com/weblog/2025/jan/14/security-releases/

Impact

With large malformed string passed for IPv6 validation can perform denial-of-service attack.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original