Potential DoS with NumberFilter conversion to integer values.
Impact
Automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents.
Patches
Version 2.4.0+ applies a MaxValueValidator with a a default limit_value of 1e50 to the form field used by NumberFilter instances.
In addition, NumberFilter implements the new get_max_validator() which should return a configured validator instance to customise the limit, or else None to disable the additional validation.
Workarounds
Users may manually apply an equivalent validator if they are not able to upgrade.
For more information
If you have any questions or comments about this advisory:
- Open an issue in the django-filter repo
Thanks to Marcin Waraksa for the report.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | django-filter | < 2.4.0 | 2.4.0 |
References
- https://github.com/carltongibson/django-filter/security/advisories/GHSA-x7gm-rfgv-w973
- https://github.com/carltongibson/django-filter/commit/340cf7a23a2b3dcd7183f6a0d6c383e85b130d2b
- https://pypi.org/project/django-filter/
- https://github.com/carltongibson/django-filter/releases/tag/2.4.0
- https://nvd.nist.gov/vuln/detail/CVE-2020-15225
- https://github.com/carltongibson/django-filter
- https://github.com/pypa/advisory-database/tree/main/vulns/django-filter/PYSEC-2021-64.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPHENTRHRAYFXYPPBT7JRHZRWILRY44S
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAT2ZAEF6DM3VFSOHKB7X3ASSHGQHJAK
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVJ7AYU6FUSU3F653YCGW5LFD3IULRSX
- https://pypi.org/project/django-filter
- https://security.netapp.com/advisory/ntap-20210604-0010
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-681- Platform
- Python (PyPI)
- Package
django-filter- Disclosed
- 28.09.2020
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2021-64 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-x7gm-rfgv-w973 - CC BY 4.0
Vulnerability history: django-filter
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.