Medium severity · published Oct 6, 2026
CVE-2026-77050
Potential denial-of-service vulnerability in get_supported_language_variant()
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is subject to
a potential denial-of-service attack when processing many distinct, very long
language codes, which are retained as keys in an in-memory cache and
consume process memory.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Gleb Lizunov for reporting this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DJ
Django · djangoproject
6.1 before 6.1.2; 6.0 before 6.0.9; 5.2 before 5.2.18 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77050
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77050
vendor-advisory
https://docs.djangoproject.com/en/dev/releases/security/
mailing-list
https://groups.google.com/g/django-announce
patch
https://github.com/django/django/commit/c88b304cc2d90fc37d3bd1f5f3829706fa6c13bc
patch
https://github.com/django/django/commit/7e878b0f8bd42260903e6a0d38996a93b0474a0b
patch
https://github.com/django/django/commit/3d32ee80ae52745d686bf94d3555000ddf073267
patch
https://github.com/django/django/commit/02a69e3791e3df23d45ea4ea7e7fc489f0eef2be
More from Django
9.8
CVE-2026-4277
Privilege abuse in GenericInlineModelAdmin
9.8
CVE-2025-59681
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7
9.8
CVE-2024-53908
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17
9.8
CVE-2023-31047
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files
9.8
CVE-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6