Django 6.1 memory exhaustion via get_supported_language_variant (before 6.1.2)
CVE-2026-77050 Published on October 6, 2026
Potential denial-of-service vulnerability in get_supported_language_variant()
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is subject to
a potential denial-of-service attack when processing many distinct, very long
language codes, which are retained as keys in an in-memory cache and
consume process memory.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Gleb Lizunov for reporting this issue.
Timeline
Initial report received.
Vulnerability confirmed. 14 days later.
Security release issued. 47 days later.
Weakness Type
What is a Stack Exhaustion Vulnerability?
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CVE-2026-77050 has been classified to as a Stack Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-77050
Want to know whenever a new CVE is published for Django Project Django? stack.watch will email you.
Affected Versions
djangoproject Django:- Version 6.1 and below 6.1.2 is affected.
- Version 6.1.2 is unaffected.
- Version 6.0 and below 6.0.9 is affected.
- Version 6.0.9 is unaffected.
- Version 5.2 and below 5.2.18 is affected.
- Version 5.2.18 is unaffected.