CVE-2019-6975

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

• CWE-770

• http://www.securityfocus.com/bid/106964Third Party Advisory, VDB Entry
• https://docs.djangoproject.com/en/dev/releases/security/Patch, Vendor Advisory
• https://groups.google.com/forum/#%21topic/django-announce/WTwEAprR0IQ
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66WMXHGBXD7GSM3PEXVCMCAGLMQYHZCU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ/
• https://seclists.org/bugtraq/2019/Jul/10
• https://usn.ubuntu.com/3890-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4476
• https://www.djangoproject.com/weblog/2019/feb/11/security-releases/Patch, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2019/02/11/1Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/106964Third Party Advisory, VDB Entry
• https://docs.djangoproject.com/en/dev/releases/security/Patch, Vendor Advisory
• https://groups.google.com/forum/#%21topic/django-announce/WTwEAprR0IQ
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66WMXHGBXD7GSM3PEXVCMCAGLMQYHZCU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ/
• https://seclists.org/bugtraq/2019/Jul/10
• https://usn.ubuntu.com/3890-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4476
• https://www.djangoproject.com/weblog/2019/feb/11/security-releases/Patch, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2019/02/11/1Mailing List, Patch, Third Party Advisory

Published

Feb 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-6969The web interface of the D-Link DVA-5592 20180823 is vulnera…7.5
• CVE-2019-6970Moodle 3.5.x before 3.5.4 allows SSRF.
• CVE-2019-6971An issue was discovered on TP-Link TL-WR1043ND V2 devices. A…
• CVE-2019-6972An issue was discovered on TP-Link TL-WR1043ND V2 devices. T…
• CVE-2019-6973Sricam IP CCTV cameras are vulnerable to denial of service v…
• CVE-2019-6974In the Linux kernel before 4.20.8, kvm_ioctl_create_device i…8.1
• CVE-2019-6976libvips before 8.7.4 generates output images from uninitiali…
• CVE-2019-6977gdImageColorMatch in gd_color_match.c in the GD Graphics Lib…
• CVE-2019-6978The GD Graphics Library (aka LibGD) 2.2.5 has a double free …
• CVE-2019-6979An issue was discovered in the User IP History Logs (aka IP_…
• CVE-2019-6980Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allo…
• CVE-2019-6981Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind…