GHSA-9v8h-57gv-qch6 · Severity: high · Ecosystem: pip — Django vulnerable to Denial of Service via i18n middleware component
The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.
Conclusion & alert: CVE-2007-5712 is rated Low Risk (39.4/100): CVSS Low severity, with medium exploitation likelihood (EPSS 1.81%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-11-24 | 1.59% | 1.81% | +0.22% |
| 2 | 2025-05-28 | 1.46% | 1.59% | +0.13% |
| 3 | 2025-03-30 | — | 1.46% | — |
Full EPSS history (15 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 2.6 | 2.0 | LOW |
|
4.9 | 2.9 | [email protected] |
GHSA-9v8h-57gv-qch6 · Severity: high · Ecosystem: pip — Django vulnerable to Denial of Service via i18n middleware component
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
low | CVE-2007-5712 low priority: Debian including 1 source packages (python-django), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2007-5712 |
redhat
|
— | — | https://access.redhat.com/security/cve/CVE-2007-5712 |
ubuntu
|
low | CVE-2007-5712 low priority: Ubuntu including 1 source packages (python-django), 5 status rows across 5 suites (dapper, edgy, feisty, gutsy, upstream): released 3, DNE 2. | https://ubuntu.com/security/CVE-2007-5712 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| django_project | django | 0.91 | cpe:2.3:a:django_project:django:0.91:*:*:*:*:*:*:* |
| django_project | django | 0.95 | cpe:2.3:a:django_project:django:0.95:*:*:*:*:*:*:* |
| django_project | django | 0.95.1 | cpe:2.3:a:django_project:django:0.95.1:*:*:*:*:*:*:* |
| django_project | django | 0.96 | cpe:2.3:a:django_project:django:0.96:*:*:*:*:*:*:* |