Resource exhaustion in Django - CVE-2026-15337
Published: August 5, 2026
Vulnerability identifier: #VU140943
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-15337
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled memory consumption in django.utils.translation.check_for_language() when checking many distinct, very long language codes. A remote attacker can send crafted POST data containing many distinct long language values to cause a denial of service.
The language value reaches this function through the django.views.i18n.set_language() view, which is not active by default, and the memory consumption is bounded by request size and cache entry limits.
Affected software
Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
python311-Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
python311-Django
How to mitigate CVE-2026-15337
Install security update from vendor's website.
Django - addressed in versions 5.2.17, 6.0.8
python311-Django - update to 4.2.11-150600.3.65.1
python311-Django - update to 4.2.11-150600.3.65.1