vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2018-7536

N/A
Published: March 9, 2018 at 12:00 AM UTC
Updated: June 17, 2026 at 02:03 AM UTC
4 products affected across 4 vendorsDebian LinuxUbuntu LinuxOpenStack

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 5%

Description

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux· Canonicalrubygems
95%
14.0416.0417.10
Debian Linux· Debiandrupal
95%
7.08.09.0
Django· Djangoprojectpypi
95%
1.11 ≤ v < 1.11.111.8 ≤ v < 1.8.192.0 ≤ v < 2.0.3
Affected range stops below 1.11.11, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.8.19, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.0.3, so it looks safe — our inference, not a vendor statement
OpenStack· Red Hatdrupal
95%
1013

References (12)

VDB EntryThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/103361
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2018:2927
Vendor AdvisoryThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:0051
Vendor AdvisoryThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:0082
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:0265
Source: [email protected]
https://github.com/django/django/commit/1ca63a66ef3163149ad822701273e8a1844192c2
Source: [email protected]
https://github.com/django/django/commit/abf89d729f210c692a50e0ad3f75fb6bec6fae16
Source: [email protected]
https://github.com/django/django/commit/e157315da3ae7005fa0683ffc9751dbeca7306c8

CVSS

5MEDIUM[email protected]
Confidentiality
NONE
Integrity
NONE
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-185

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card