CVE-2024-39317
Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.
- Affected products
- Wagtail
- Torchbox Wagtail
- < 5.2.6, 6.0.6, 6.1.3
- Fix
- Available
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 0.6% (46th percentile)
- Weakness
- CWE-1333
- NVD status
- Analyzed
- Published
- 2024-07-11
No indexed exploits for CVE-2024-39317 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-39317 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.