An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. (CVE-2026-77050)

CVE-2026-77050 affects Django versions 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. The vulnerability arises from the get_supported_language_variant() function in django.utils.translation, which caches language codes as keys in memory. When many distinct and very long language codes are processed, this cache grows significantly, potentially causing a denial-of-service condition due to excessive memory consumption. Earlier unsupported Django series such as 5.1.x, 5.0.x, and 4.2.x were not evaluated but may also be affected. The issue was reported by Gleb Lizunov.

The vulnerability allows an attacker to cause a denial-of-service by exhausting server memory through the submission of many distinct, very long language codes. This does not affect confidentiality or integrity but impacts availability by potentially crashing or severely degrading the Django application.

Official fixes are available in Django versions 6.1.2, 6.0.9, and 5.2.18. Users should upgrade to these or later versions to remediate the vulnerability. No vendor advisory content was provided beyond version information, so patch status is confirmed by the version numbers stated. No additional mitigations are specified.