CVE-2024-39317CWE-1333

Wagtail regular expression denial-of-service via search query parsing

Medium · published July 11, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00615 · 48.9th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2024-07-11T15:23Z
EPSS history
Timeline
  • 11 JUL 15:23Z
    Wagtail regular expression denial-of-service via search query parsing
    cvelistv5