CVE-2018-7537

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

• CWE-185

• http://www.securityfocus.com/bid/103357Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:2927Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0265Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/03/msg00006.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/3591-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4161Third Party Advisory
• https://www.djangoproject.com/weblog/2018/mar/06/security-releases/Release Notes, Vendor Advisory
• http://www.securityfocus.com/bid/103357Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:2927Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0265Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/03/msg00006.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/3591-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4161Third Party Advisory
• https://www.djangoproject.com/weblog/2018/mar/06/security-releases/Release Notes, Vendor Advisory

Published

Mar 9, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7531An Improper Input Validation issue was discovered in OSIsoft…
• CVE-2018-7532Unauthentication vulnerabilities have been identified in Geu…
• CVE-2018-7533An Incorrect Default Permissions issue was discovered in OSI…
• CVE-2018-7534In Stealth Authorization Server before 3.3.017.0 in Unisys S…
• CVE-2018-7535An issue was discovered in TotalAV v4.1.7. An unprivileged u…
• CVE-2018-7536An issue was discovered in Django 2.0 before 2.0.3, 1.11 bef…
• CVE-2018-7538A SQL injection vulnerability in the tracker functionality o…
• CVE-2018-7539On Appear TV XC5000 and XC5100 devices with firmware 3.26.21…
• CVE-2018-7540An issue was discovered in Xen through 4.10.x allowing x86 P…
• CVE-2018-7541An issue was discovered in Xen through 4.10.x allowing guest…
• CVE-2018-7542An issue was discovered in Xen 4.8.x through 4.10.x allowing…
• CVE-2018-7543Cross-site scripting (XSS) vulnerability in installer/build/…6.1