CVE-2024-56374: Denial-of-service vulnerability in IPv6 validation

How it was found

Hi IBB Team, :)

I discovered a vulnerability in Django related to IPv6 validation that could potentially lead to a denial-of-service attack. You can find the details of my report and the assigned (CVE-2024-42005) at the following links:

• https://www.djangoproject.com/weblog/2025/jan/14/security-releases/
• https://github.com/django/django/commit/ca2be7724e1244a4cb723de40a070f873c6e94bf#diff-dde021d7427efcb4de60b971a1dbcafb0aa3732f263572be835a311d8be20d96R10

Impact

Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address were vulnerable, as was the django.forms.GenericIPAddressField form field, which has now been updated to define a max_length of 39 characters.