An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3160 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Jinja sandbox breakout through attr filter selecting format method     (CVE-2025-27516)

    * python3.11-jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516)

    * python3.11-django: Potential denial-of-service vulnerability in django.utils.text.wrap()     (CVE-2025-26699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation Platform
    * Fixed an issue when migrating user accounts with invalid email addresses, the process would print a     message showing the user name of the user whose email address has been removed (AAP-42146)
    * When migrating user accounts with invalid email addresses the process will print a message showing the     user name of the user whose email address has been removed (AAP-41675)
    * automation-gateway has been updated to 2.5.20250326
    * python3.11-django-ansible-base has been updated to 2.5.20250326

    Automation controller
    * Fixed the host metrics to no longer collect host metrics for dark/unreachable hosts (AAP-41567)
    * Removed ANSIBLE_COLLECTIONS_PATHS from the controllers job output due to the discontinuation of     ansible-engine 2.9 (AAP-41566)
    * Fixed the system auditor to no longer download the execution node install bundle (AAP-37922)
    * Fixed host records to no longer be added to the HostMetric if the host had only failures or unreachable     tasks done (AAP-32094)
    * automation-controller has been updated to 4.6.10

    Automation hub
    * Fixed an issue where the user could not delete automation hub teams on the resource API (AAP-42158)
    * Added a migration file to set the default value of retain_repo_versions to 1 for validated repositories     (AAP-42005)
    * automation-hub has been updated to 4.10.3
    * python3.11-galaxy-ng has been updated to 4.10.3
    * python3.11-pulpcore has been updated to 3.49.34

    RPM-based Ansible Automation Platform
    * Fixed issue where preflight was not accounting for automationgateway being a CA server node (AAP-41817)
    * Fixed gateway installations which resulted in failures in environments with IPv6 due to nginx     configuration timing (AAP-41816)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-10

    Additional changes:
    * python3.11-django has been updated to 4.2.20
    * python3.11-jinja2 has been updated to 3.1.6

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:0959-1 advisory.

    - CVE-2025-26699: Fixed potential denial-of-service in django.utils.text.wrap() (bsc#1239052).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4086 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4086-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     March 19, 2025                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 2:2.2.28-1~deb11u6     CVE ID         : CVE-2025-26699     Debian Bug     : 1099682

    It was discovered that there was a potential denial-of-service (DoS)     vulnerability in Django, a Python-based web development framework.

    The issue was situated in the wrap() method of the django.utils.text     module. This method and the wordwrap template filter were subject to     a potential DoS attack when used with very long strings.

    For Debian 11 bullseye, this problem has been fixed in version     2:2.2.28-1~deb11u6.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-d58f8ec8ec advisory.

    ix for CVE-2025-26699: Potential denial-of-service vulnerability in django.utils.text.wrap()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-da3777e8c4 advisory.

    ix for CVE-2025-26699: Potential denial-of-service vulnerability in django.utils.text.wrap()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-9c039322cf advisory.

    Fix for CVE-2025-26699: Potential denial-of-service vulnerability in django.utils.text.wrap()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6f24ee84e8 advisory.

    Fix for CVE-2025-26699: Potential denial-of-service vulnerability in django.utils.text.wrap()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The     django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service     attack when used with very long strings. (CVE-2025-26699)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7335-1 advisory.

    It was discovered that Django incorrectly handled text wrapping. An attacker could possibly use this issue     to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
233518	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2025:3160)	Nessus	Red Hat Local Security Checks	medium
233041	SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2025:0959-1)	Nessus	SuSE Local Security Checks	medium
232990	Debian dla-4086 : python-django-doc - security update	Nessus	Debian Local Security Checks	medium
232920	Fedora 40 : python-django4.2 (2025-d58f8ec8ec)	Nessus	Fedora Local Security Checks	medium
232917	Fedora 41 : python-django4.2 (2025-da3777e8c4)	Nessus	Fedora Local Security Checks	medium
232844	Fedora 40 : python-django (2025-9c039322cf)	Nessus	Fedora Local Security Checks	medium
232831	Fedora 41 : python-django (2025-6f24ee84e8)	Nessus	Fedora Local Security Checks	medium
232266	Linux Distros Unpatched Vulnerability : CVE-2025-26699	Nessus	Misc.	medium
232216	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Django vulnerability (USN-7335-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2025-26699

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium