CVE-2019-14235

Vulnerability

Details

CVE-2019-14235 is a denial-of-service (DoS) vulnerability in Django's django.utils.encoding.uri_to_iri function. When processing certain crafted inputs containing invalid UTF-8 octet sequences, the function enters deep recursion during re-percent-encoding, leading to significant memory consumption and potentially causing the application to crash or become unresponsive [1][2].

Exploitation

An attacker can trigger this vulnerability by sending specially crafted HTTP requests with malformed URI components that are processed by uri_to_iri(). No authentication or special privileges are required; the attack can be carried out remotely if the application reflects or processes user-supplied URIs [3]. The issue affects Django versions prior to 1.11.23, 2.1.11, and 2.2.4 [4].

Impact

The primary impact is a denial of service, where the application may exhaust available memory, leading to degraded performance or a complete crash. This can disrupt service availability for legitimate users. There is no evidence of code execution or data leakage resulting from this vulnerability [3][4].

Mitigation

The Django team released security updates on August 1, 2019, addressing this issue in Django 1.11.23, 2.1.11, and 2.2.4. The fix avoids recursion when re-percent-encoding invalid UTF-8 octet sequences [4]. Users are strongly advised to upgrade to the latest patched versions. No workarounds have been officially provided; upgrading is the recommended course of action.