CVE-2026-77050
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_languag
CVSS
5.3
Medio
EPSS
0.4%
p31
KEV
—
Exploit Today
9
0-100
Publicado: 6 oct 2026 · Última mod.: 6 oct 2026 · CWE-789
0.4%EPSS · 30 días0.4%
2026-10-072026-10-21
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Gleb Lizunov for reporting this issue.
- docs.djangoproject.comhttps://docs.djangoproject.com/en/dev/releases/security/
- github.comhttps://github.com/django/django/commit/02a69e3791e3df23d45ea4ea7e7fc489f0eef2be
- github.comhttps://github.com/django/django/commit/3d32ee80ae52745d686bf94d3555000ddf073267
- github.comhttps://github.com/django/django/commit/7e878b0f8bd42260903e6a0d38996a93b0474a0b
- github.comhttps://github.com/django/django/commit/c88b304cc2d90fc37d3bd1f5f3829706fa6c13bc
- groups.google.comhttps://groups.google.com/g/django-announce
- www.djangoproject.comhttps://www.djangoproject.com/weblog/2026/oct/06/security-releases/
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1136045.5 MED5.2%
——2Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.3dCVE-2026-112399—20.5%
——6Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.3dCVE-2026-1122835.5 MED1.6%
——0VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.1dCVE-2026-1122146.5 MED10.1%
——3A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.4dCVE-2026-1120486.1 MED1.6%
——0libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.3dCVE-2026-1112797.5 ALT40.7%
——12Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.7d