CVE-2024-41989: Denial-Of-Service vulnerability in the floatformat template filter when input string contains a big exponent in scientific notation

拒绝服务 / 资源消耗失控 / #2644244

厂商

Internet Bug Bounty

严重程度

低危 · CVSS 5.3

赏金

$2,142

弱点

资源消耗失控

研究员

@l33thaxor

披露日期

2024-09-22

资产

https://github.com/django

CVE

CVE-2024-41989

该报告还没有中文解读。

This vulnerability exists in the `floatformat` input filter when an attacker can pass a string with an `"e"` character in it to the input filter. This vulnerability takes advantage of the way strings with scientific exponents are converted internally to integers.