Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-django) security update
Affects Red HatSource GCVE Database
Not known to be exploited · CVSS 5.3 Medium : upgrade Red Hat to 4.2.7 when convenient.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 1.8% chance of exploitation in 30 days – higher than 79% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 4.2.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HExploitation evidence
Disclosed: evidence found.
CVE published 15 Mar 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade django to 4.2.7.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
PyPIdjangopkg:pypi/djangoOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Red Hat has released a security update for python-django in Red Hat OpenStack Platform 17.1 that addresses this vulnerability. Administrators should apply the provided update as described in Red Hat advisory RHSA-2025:4187 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor. Patch status is confirmed as fixed by Red Hat.
Description
A potential regular expression denial-of-service (ReDoS) vulnerability exists in the django.utils.text. Truncator.words() function in the python-django package used by Red Hat OpenStack Platform 17.1. This vulnerability is identified as CVE-2024-27351 and has been rated with moderate severity by Red Hat Product Security. The issue could allow an attacker to cause a denial-of-service condition by exploiting inefficient regular expression processing. Red Hat has issued a security update addressing this vulnerability for affected versions. No known exploits are reported in the wild at this time.