CVE-2026-77050

Executive Summary

CVE-2026-77050 is a denial-of-service vulnerability in the Django web framework affecting versions 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. The function django.utils.translation.get_supported_language_variant() retains many distinct, very long language codes as keys in an in-memory cache, causing unbounded memory consumption and potential process exhaustion. Any internet-exposed Django deployment that processes attacker-influenced language codes is at risk, though the CVSS v3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates a moderate, availability-only impact with no public proof-of-concept or exploit code currently available.

Technical Analysis

The vulnerability is classified as CWE-789 (Memory Allocation with Excessive Value), a weakness where software allocates memory based on a value that is not adequately bounded or constrained. In this case, the affected code path is the Django translation utility function django.utils.translation.get_supported_language_variant().

Per the NVD description, this function is "subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory." The core mechanism is a resource-exhaustion pattern:

• Input surface: Language codes, which in Django-based applications are frequently derived from request data — including Accept-Language HTTP headers, URL query parameters, or other user-controllable inputs that are passed to language-resolution logic.
• Caching behavior: When get_supported_language_variant() resolves a requested language code, the code is stored as a key in an in-memory cache. If the function is invoked repeatedly with many distinct language codes, and each code is very long, the aggregate number and size of the cache keys grows without an effective upper bound.
• Impact on the process: Because the cache is held in process memory, sustained requests with unique, oversized language codes inflate the resident memory footprint of each Django worker. Enough distinct long values across enough requests drives memory pressure until the worker, or the process manager supervising it, collapses — resulting in denial of service.

The CVSS subscores corroborate this read: AV:N (network reachable), AC:L (no special conditions), PR:N (no authentication needed), UI:N (no user interaction), S:U (impact confined to the vulnerable component), and crucially C:N/I:N/A:L — no confidentiality or integrity impact, with only a low availability impact. That low availability rating is consistent with a slow-burn memory exhaustion rather than an immediate, deterministic crash: an attacker must send many distinct long values to accumulate meaningful memory pressure.

Importantly, the NVD description states that earlier, unsupported Django series (5.1.x, 5.0.x, and 4.2.x) "were not evaluated and may also be affected." This means the true affected-version surface may be broader than the three patched branches. No CVE-specific weakness in authentication, session handling, or data confidentiality is described; the exclusive concern is availability via unbounded cache-key growth. No specific parameter names, URL endpoints, or file paths beyond get_supported_language_variant() are provided in the source data, and none should be inferred.

Exploitation Scenarios

There is no public proof-of-concept, exploit code, or Nuclei template associated with CVE-2026-77050. The attack chain below is therefore described at the vulnerability-class level, strictly grounded in the described behavior of get_supported_language_variant().

1. Reconnaissance / target identification. The attacker identifies an internet-exposed application built on an affected Django version (6.1 < 6.1.2, 6.0 < 6.0.9, or 5.2 < 5.2.18). Fingerprinting is aided by common Django artifacts such as the csrfmiddlewaretoken form field, Set-Cookie session cookies, or characteristic error/admin pages. The attacker focuses on any endpoint or middleware path where client-supplied language codes reach Django's translation-resolution logic — most commonly through the Accept-Language request header, but potentially via query parameters or cookies depending on application configuration.

2. Triggering the flaw class (unbounded memory allocation). The attacker sends requests that supply language codes. To exploit the described mechanism, the attacker must satisfy two conditions simultaneously: the codes must be distinct (so each becomes a new, separate cache key rather than reusing an existing entry) and very long (so each key consumes disproportionate memory). By iterating across many unique, oversized language-code strings, the attacker forces the in-memory cache to accumulate an ever-growing set of large keys.

3. Payload / execution method. At the vulnerability-class level, the "payload" is the crafted language-code input itself, delivered through the request vector that reaches get_supported_language_variant(). No code execution is involved and none is claimed; the malicious content is high-entropy, high-length, unique language-code strings that are valid enough to be processed by the function yet unbounded enough to defeat any size or cardinality limit on caching.

4. Post-exploitation impact. There is no confidentiality or integrity impact. The outcome is availability degradation: progressive growth of process memory, leading to worker instability (restarts, OOM kills, or outright unavailability of the affected service). Because the impact is rated low and requires sustained effort, the practical effect is a resource-exhaustion denial of service against a targeted deployment, not a catastrophic single-request crash.

No public exploit exists; the described chain is inferred from the vulnerability class (CWE-789 / denial of service via unbounded caching) and the NVD description.

Impact Assessment

CVE-2026-77050 is an availability-only vulnerability. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L yields a base score of 5.3 (MEDIUM), with the subscores conveying:

• Attack Vector — Network (N): Exploitable remotely over the network.
• Attack Complexity — Low (L): No specialized conditions or race windows are required.
• Privileges Required — None (N): No authentication is needed to deliver the triggering input.
• User Interaction — None (N): No victim action is required.
• Scope — Unchanged (U): The impact stays within the vulnerable Django process; no cross-component escape.
• Confidentiality — None (N): No data exposure.
• Integrity — None (N): No data or logic tampering.
• Availability — Low (L): Degraded availability; memory pressure accumulates rather than immediate total loss.

Affected systems and blast radius: Applications running Django 6.1 (< 6.1.2), 6.0 (< 6.0.9), or 5.2 (< 5.2.18). Because the NVD description notes that earlier, unsupported series (5.1.x, 5.0.x, 4.2.x) "may also be affected," the real-world blast radius may extend to end-of-life deployments that will not receive fixes. Any deployment where attacker-influenced language codes reach the translation-resolution path is potentially exposed.

Business impact: The principal risk is service unavailability. In multi-tenant or high-traffic environments where a single process handles many requests, memory inflation can cascade to worker restarts, request queue buildup, and cascading timeouts. Because no authentication is required and no user interaction is needed, an unauthenticated remote actor can mount the attack at will. The low availability rating and the requirement for sustained, high-volume, distinct-long inputs temper the severity, but prolonged targeting of an unmitigated host can still produce meaningful downtime. The EPSS score has not been assigned by FIRST.org, and the vulnerability is not listed in CISA KEV, so there is no evidence of active in-the-wild exploitation at this time.

Detection Guidance

Given the nature of this vulnerability — accumulation of oversized, distinct cache keys via language codes — detection requires correlating network-level language-code anomalies with process-memory anomalies on the Django host.

Sigma Rule

title: Potential Django get_supported_language_variant Memory Exhaustion (CVE-2026-77050)
id: 8b3f2a1c-7705-4d9e-9c1a-djangocve24
status: experimental
description: Detects HTTP requests containing abnormally long or highly distinct Accept-Language values consistent with CVE-2026-77050 resource-exhaustion attempts against Django.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77050
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.77050
logsource:
  category: webserver
  product: django
detection:
  selection_header:
    cs-method: 'GET'
  selection_lang:
    cs-uri-query|contains: 'lang'
  selection_long:
    cs(Referer)|contains: 'Accept-Language'
  condition: selection_lang or selection_long
fields:
  - c-ip
  - cs-method
  - cs-uri-query
level: medium
falsepositives:
  - Legitimate clients sending long Accept-Language strings

YARA Rule

rule CVE_2026_77050_Django_Language_DoS
{
    meta:
        description = "Detects oversized, high-entropy language-code strings in request logs or PCAP payloads targeting Django translation resolution (CVE-2026-77050)"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77050"
        cve = "CVE-2026-77050"

    strings:
        $lang_hdr = "Accept-Language" nocase ascii
        $lang_q   = "lang=" nocase ascii
        $django   = "get_supported_language_variant" ascii

    condition:
        (uint16(0) == 0x4854) and
        (any of ($lang_hdr, $lang_q)) and
        filesize > 2048
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77050 Django get_supported_language_variant potential memory-exhaustion attempt"; flow:established,to_server; http.header; content:"Accept-Language"; nocase; pcre:"/Accept-Language\x3a\s*[A-Za-z0-9\-_,;=q. ]{512,}/i"; threshold:type both, track by_src, count 50, seconds 60; classtype:attempted-dos; reference:cve,2026-77050; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77050; sid:202677050; rev:1;)

Elastic Detection

// CVE-2026-77050: repeated requests with long, distinct Accept-Language values
// targeting Django translation resolution.
sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and
      http.request.method == "GET" and
      /* flag oversized Accept-Language header values */
      length(http.request.headers."accept-language") > 400 ]
  [ network where network.protocol == "http" and
      length(http.request.headers."accept-language") > 400 ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=httplogs
| eval al=coalesce(accept_language, accept-language)
| where len(al) > 400 OR (lang=* AND len(lang) > 400)
| stats count dc(al) as distinct_langs values(method) as method by src_ip
| where count > 50 AND distinct_langs > 20
| sort - distinct_langs

Wazuh OSSEC Rule

<group name="django,cve-2026-77050,web,">
  <rule id="100770" level="8">
    <decoded_as>json</decoded_as>
    <field name="accept_language">\.{400,}</field>
    <description>CVE-2026-77050: oversized language code observed (potential Django memory exhaustion).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100771" level="10" frequency="50" timeframe="60">
    <if_matched_sid>100770</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-77050: sustained large language-code submissions from same source (likely DoS attempt).</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix URL, workaround, or tracked patch source was recorded in the intelligence data. The NVD description, however, identifies fixed releases for the maintained branches.

1. Immediate mitigations.

   • Enforce input length and cardinality limits on any attacker-influenced input that reaches language resolution — particularly the Accept-Language header and any query-parameter or cookie-derived language values. Reject or truncate language codes exceeding a sane maximum length and reject values that do not match an expected language-tag format.
   • Place a reverse proxy, WAF, or CDN in front of Django deployments and configure it to cap request-header sizes and normalize/limit language codes before they reach the application.
   • Apply per-source rate limiting and anomaly thresholds to detect the sustained, high-volume, distinct-value pattern this attack requires.
   • Monitor worker process memory closely; configure process managers to restart workers on memory thresholds as a containment measure (aware that this alone does not fix the flaw).
   • Treat end-of-life series (5.1.x, 5.0.x, 4.2.x) as potentially affected, since they were not evaluated, and plan to retire or migrate them.

2. Patch / upgrade steps.

   • Upgrade Django to a fixed release: 6.1.2 or later (6.1 branch), 6.0.9 or later (6.0 branch), or 5.2.18 or later (5.2 branch).
   • After upgrading, verify the patch by re-testing the affected code path and confirming that memory is no longer retained for oversized, distinct language codes.
   • Because no patch evidence was tracked from any automated source, treat this guidance as advisory pending confirmation from the official Django security release.

3. Long-term hardening.

   • Apply defensive bounds at the framework boundary: cap the size and count of any inputs that are cached in-process, and prefer bounded caches with eviction policies for externally influenced keys.
   • Adopt a regular Django security-release cadence; subscribe to official Django security announcements so future advisories are actioned quickly.
   • Include resource-exhaustion/DoS scenarios in security testing and capacity planning, since availability-only CVEs are often under-prioritized despite being trivially reachable.

References

• NVD: CVE-2026-77050 — https://nvd.nist.gov/vuln/detail/CVE-2026-77050
• Django Project security releases (advisory for CVE-2026-77050 referencing Gleb Lizunov's report) — django start of official disclosure; consult the official Django security releases page for the final advisory text.
• MITRE CWE-789: Memory Allocation with Excessive Value — https://cwe.mitre.org/data/definitions/789.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (score not yet assigned) — https://www.first.org/epss/

No known threat-actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-77050 at the time of writing. No public PoC, Nuclei template, or exploit code is available, and the CVE is not listed in CISA KEV.