CVE-2026-77050: CWE-789: Memory Allocation with Excessive Size Value in djangoproject Django

This vulnerability (CVE-2026-77050) in Django arises from the handling of language codes in the get_supported_language_variant() function. When many distinct and very long language codes are processed, they are retained as keys in an in-memory cache, causing excessive memory allocation (CWE-789). This can lead to denial-of-service by exhausting process memory. The affected versions are Django 6.1 prior to 6.1.2, 6.0 prior to 6.0.9, and 5.2 prior to 5.2.18. The issue was reported by Gleb Lizunov. There is no indication of known exploits in the wild.

The vulnerability allows an attacker to cause a denial-of-service condition by forcing the Django process to consume excessive memory through the caching of many distinct, very long language codes. This impacts availability but does not affect confidentiality or integrity. No known exploitation in the wild has been reported.

Fixed versions are available: Django 6.1.2, 6.0.9, and 5.2.18 address this issue. Users should upgrade to these or later versions to remediate the vulnerability. No vendor advisory content was provided to indicate otherwise. Patch status is confirmed by the version ranges indicating fixed versions. No additional mitigation steps are specified.