This vulnerability arises from the django.utils.translation.check_for_language() function retaining many distinct, very long language codes as keys in an in-memory cache, which can cause excessive memory consumption and a denial-of-service condition. The language codes reach this function through the django.views.i18n.set_language() view, which is not enabled by default. The memory usage is bounded by the DATA_UPLOAD_MAX_MEMORY_SIZE setting (default 2.5 MB) and a fixed maximum number of cache entries. The issue affects Django 5.2 versions prior to 5.2.17 and Django 6.0 versions prior to 6.0.8. Earlier unsupported versions such as 5.1.x, 5.0.x, and 4.2.x were not evaluated but may also be vulnerable. No official remediation level or patch information is provided in the advisory.

The vulnerability can lead to denial-of-service by causing the Django process to consume excessive memory when handling many distinct, very long language codes. This can degrade service availability. There is no impact on confidentiality or integrity. The attack vector is network-based with no privileges required and no user interaction needed. The affected view is not routed by default, which reduces exposure. Memory consumption is limited by existing Django settings and cache size, bounding the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerable view django.views.i18n.set_language() is not routed by default, exposure can be minimized by not enabling this view. Additionally, the default DATA_UPLOAD_MAX_MEMORY_SIZE setting limits memory consumption. Monitor vendor updates for official patches or fixes and apply them when available.