CVE-2019-14232

A catastrophic backtracking vulnerability exists in Django's django.utils.text.Truncator class when the chars() and words() methods are called with html=True [2]. The affected methods are used by the truncatechars_html and truncatewords_html template filters. The regular expression used to parse HTML-like input can cause exponential backtracking on specially crafted strings, leading to severe performance degradation.

Exploitation requires an attacker to provide input that triggers the vulnerable regex pattern, either directly to the Truncator methods or indirectly through template filters that accept user-controlled data [3]. No authentication is necessary if the application exposes these filters to unauthenticated users. The attack can be performed over HTTP by sending a request with a malicious string.

Successful exploitation leads to a denial-of-service condition, as the CPU becomes occupied processing the regex, potentially rendering the web server unresponsive. The vulnerability is classified as a ReDoS (Regular Expression Denial of Service) and can be exploited remotely without privileges.

The Django project released patches in versions 1.11.23, 2.1.11, and 2.2.4, which contain a fixed regular expression that avoids catastrophic backtracking [3]. Users are strongly advised to upgrade to these or later versions. No workaround is available for older versions.