Django Denial-of-Service Vulnerability in strip_tags() Function

A denial-of-service vulnerability has been identified in Django versions 4.2 prior to 4.2.21, 5.1 prior to 5.1.9, and 5.2 prior to 5.2.1. The issue arises in the django.utils.html.strip_tags() function, which can experience slow performance when processing inputs with large sequences of incomplete HTML tags. This vulnerability can lead to service degradation or unresponsiveness. Additionally, the 'striptags' template filter, which relies on the strip_tags() function, is also affected.

Impact

Exploitation of this vulnerability can cause significant slowdowns in application performance, leading to potential service outages or unresponsiveness.

Remediation

Users can upgrade to Django versions 5.2.1, 5.1.9, or 4.2.21 to address this vulnerability.