CVE-2024-21520

Deeper analysis

Versions of the djangorestframework package before 3.15.2 contain a cross-site scripting vulnerability in the break_long_headers template filter. The issue stems from insufficient input sanitization prior to splitting header values and rejoining them with <br> tags, allowing attacker-controlled content to be rendered as HTML.

An unauthenticated remote attacker can supply malicious input that reaches the affected filter. Successful exploitation results in script execution in a victim's browser, with limited impact on confidentiality, integrity, and availability as reflected in the CVSS 2.1 rating that requires user interaction.

The referenced GitHub commits and package comparison show that the maintainers addressed the flaw by releasing version 3.15.2; the Snyk advisory likewise recommends upgrading to that version to eliminate the unsanitized code path.

EPSS for the CVE rose from lower values to a peak of 0.1627 on 2025-12-11 before receding to the current 0.0840, indicating measurable post-disclosure exploitation interest that warrants renewed attention.