High severityNVD Advisory· Published Oct 13, 2009· Updated Jun 16, 2026
CVE-2009-3695
CVE-2009-3695
Description
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
DjangoPyPI | >= 1.0, < 1.0.4 | 1.0.4 |
DjangoPyPI | >= 1.1, < 1.1.1 | 1.1.1 |
Affected products
3cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
20- www.djangoproject.com/weblog/2009/oct/09/security/nvdPatchVendor Advisory
- www.securityfocus.com/bid/36655nvdPatch
- www.vupen.com/english/advisories/2009/2871nvdPatchVendor Advisory
- secunia.com/advisories/36948nvdVendor Advisory
- secunia.com/advisories/36968nvdVendor Advisory
- github.com/advisories/GHSA-p6m5-h7pp-v2x5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2009-3695ghsaADVISORY
- bugs.debian.org/cgi-bin/bugreport.cginvdWEB
- groups.google.com/group/django-users/browse_thread/thread/15df9e45118dfc51ghsaWEB
- www.debian.org/security/2009/dsa-1905nvdWEB
- www.djangoproject.com/weblog/2009/oct/09/securityghsaWEB
- www.openwall.com/lists/oss-security/2009/10/13/6nvdWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/53727nvdWEB
- github.com/django/django/commit/594a28a9044120bed58671dde8a805c9e0f6c79aghsaWEB
- github.com/django/django/commit/e3e992e18b368fcd56aabafc1b5bf80a6e11b495ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2009-4.yamlghsaWEB
- web.archive.org/web/20091013093057/http://secunia.com/advisories/36968ghsaWEB
- web.archive.org/web/20091017070244/http://secunia.com/advisories/36948ghsaWEB
- web.archive.org/web/20200228171918/http://www.securityfocus.com/bid/36655ghsaWEB
- groups.google.com/group/django-users/browse_thread/thread/15df9e45118dfc51/nvd
News mentions
0No linked articles in our index yet.