CVE-2023-36053

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-36053 affects Django versions 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3. The flaw resides in the EmailValidator and URLValidator classes, which rely on regular expressions that can be forced into catastrophic backtracking when presented with input containing an extremely large number of domain-name labels.

An unauthenticated remote attacker can supply a maliciously crafted email address or URL containing thousands of labels in the domain portion. Because the vulnerable validators perform no length or complexity checks before matching, processing such input consumes excessive CPU time and can render the validating application unresponsive, achieving a denial-of-service condition without any authentication or user interaction.

Official Django security advisories and downstream distribution notices direct users to upgrade immediately to 3.2.20, 4.1.10, or 4.2.3 or later; these releases contain revised validators that limit label count and avoid the expensive regex path. The associated EPSS score has remained essentially flat near 0.1 since disclosure, indicating limited observed exploitation interest to date.