An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

The remote host is affected by the vulnerability described in GLSA-202509-03 (Django: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Django. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0501 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-26699:
    An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The     django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service     attack when used with very long strings.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8609 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * python3-django/python39-django: Potential denial-of-service vulnerability in django.utils.text.wrap()     (CVE-2025-26699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation controller
    * Updated license mechanism to allow users to provide username and password when fetching subscriptions     via the API and AAP User Interface (AAP-46837)
    * Fixes Workflow Visualizer occasionally freezing with higher node counts (AAP-46620)
    * Fixed 'useThrottle' so the Jobs List page does not spam the API when websocket events roll in     (AAP-46551)
    * Fixed analytics collector failure to clean up temporary files after failed upload to Hybrid Cloud     Console (AAP-45967)
    * Updated dispatcher to recycle idle workers based on age, or after completing last task. Extended the     default maximum age to 4 hours, configurable by setting 'WORKER_MAX_LIFETIME_SECONDS' to desirable time,     or setting to None to disable worker recycling (AAP-45948)
    * Updated help text on the credentials creation page (AAP-45499)
    * Added a bulk update sorting utility method to prevent database deadlocks and normalize batch size     (AAP-45122)
    * Replaced basic auth with service account authentication for AAP Subscription management (AAP-44642)
    * Updated banner on the Credentials form (specifically for Insights credentials) to inform the user to     enter client ID and secret to create an Insights credential (AAP-43235)
    * Updated field names and help text in the System Settings UI to indicate client ID and client secret for     service accounts, as well as client ID and client secret for Analytics (AAP-43161)
    * Updated banner and field names in the Subscription editing UI to indicate that Ansible subscriptions now     require a service account from Hybrid Cloud Console (AAP-43160)
    * automation-controller has been updated to 4.5.23

    Automation hub
    * Restricted EE pull access to explicitly authorized users (AAP-46525)
    * automation-hub has been updated to 4.9.4
    * python3-galaxy-ng/python39-galaxy-ng has been updated to 4.9.4
    * python3-pulp-ansible/python39-pulp-ansible has been updated to 0.20.11

    Additional changes:
    * python3-django/python39-django has been updated to 4.2.21
    * installer and setup have been updated to 2.4-12

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:4553 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Potential denial-of-service vulnerability in django.utils.text.wrap()     (CVE-2025-26699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation Platform
    * Refactored the authenticate() method inside the AuthenticatorPlugin class in legacy_password.py and     legacy_sso.py to their common parent LegacyMixin. Added comments to classes and their methods for code     clarity (AAP-44460)
    * Allow gateway to be installed with a different name for the admin user (AAP-44180)
    * Added a grpc_defaults.py file which can contain override information for the GRPC server settings     (AAP-44176)
    * Changed anchor tag on api html view to button tag so that it doesn't violate semantic rules (AAP-43802)
    * Fixed how exceptions are handled on SSO login allowing for error messages to be properly captured     (AAP-43369)
    * LDAP Authenticator field USER_SEARCH field now properly supports LDAP Unions (AAP-42883)
    * Logging level was changed to eliminate X-DAB-JW-TOKEN header messages when logging level is info     (AAP-38169)
    * Job event streaming is now supported without a websocket connection (AAP-43894)
    * Implemented a throttled session refresh mechanism triggered by mouse pointer movements (AAP-43622)
    * Resolved occasional flickering in Execution Environment Select dropdown (AAP-43546)
    * Added toolbar to search Rulebook Activation History logs (AAP-43338)
    * Added an enhanced log viewer for Rulebook Activation Instances similar to the Job Output logger     (AAP-43337)
    * Fixed an issue where the job output was slow and making it hard to read due to missing parts of the     output (AAP-41434)
    * Added a notice for users who are waiting on a running job to start its playbook execution (AAP-41399)
    * Performance improvements were made to authentication method mappings UI (AAP-40963)
    * Fix that now allows customers to view output details for filtered job outputs (AAP-38925)
    * Added ability to edit an existing rulebook activation (AAP-37299)
    * automation-gateway has been updated to 2.5.20250507
    * automation-gateway-proxy has been updated to 2.5.10
    * python3.11-django-ansible-base has been updated to 2.5.20250507

    Automation controller
    * Fixed incorrect deprecation warning for awx.awx.schedule_rrule (AAP-43474)
    * Fixed usage of Django password validator UserAttributeSimilarityValidator (AAP-43046)
    * Fixed facts so they are no longer unintentionally deleted when the inventory is modified during a Job     execution (AAP-39365)
    * Implemented GitHub App credential type (AAP-38589)
    * automation-controller has been updated to 4.6.12
    * receptor has been updated to 1.5.5

    Event-Driven Ansible
    * Fixed an issue where the drools rule engine used in ansible-rulebook was keeping events that do not     match in memory for the default_events_ttl of two hours causing a memory leak (AAP-44899)
    * Fixed a bug where the activation fails with message It will attempt to restart (1/5) in 60 seconds     according to the restart policy always but it does not restart (AAP-43969)
    * Fixed a bug special characters such as [] were not allowed in the activation name on OCP deployment     (AAP-43742)
    * Enhanced the AAP injectors for eda-server to include common platform variables as extra_vars or     environment variables if they are specified (AAP-43029)
    * Fixed a bug where sometimes the container was not deleted correctly or it misses the last output entries     in VM based installations (AAP-42935)
    * Added the support for restarting the activation in the rulebook activation module in the eda collection     (AAP-42542)
    * Allows for AAP aliases to be used to specify eda collections variables to ensure common platform env     variables and module variables can be used in the eda collection (AAP-42280)
    * Added log tracking id to each log messages labelled as [tid: uuid-pattern] (AAP-42270)
    * Added x-request-id to each log message labelled as [rid:uuid-pattern] (AAP-42269)
    * EDA Decision Environment validation errors now display under the decision environment text box in the     decision environment UI page (AAP-42147)
    * If a source plugin terminates we should now be able to see the stack trace with the source file name,     the function name and line number (AAP-41774)
    * Addressed the cascading delete so that rulebook activations and event streams remain, after the user who     created them is deleted (AAP-41769)
    * Passed Controller URL is correctly validated (AAP-41575)
    * Enables decision environment image to authenticate and pull successfully when using an image registry     with a custom port (AAP-41281)
    * Relevant settings and versions are emitted in logs when the ansible-rulebook starts in worker mode     (AAP-40781)
    * ansible-rulebook has been updated to 1.1.6
    * automation-eda-controller has been updated to 1.1.8
    * python3.11-drools-jpy has been updated to 0.3.10
    * python3.11-drools-jpy-jar has been updated to 1.0.7
    * python3.11-podman has been updated to 5.4.0

    Automation hub
    * automation-hub has been updated to 4.10.4
    * python3.11-galaxy-importer has been updated to 0.4.29
    * python3.11-galaxy-ng has been updated to 4.10.4

    Container-based Ansible Automation Platform
    * Updated the installer to use ansible.platform collection (AAP-44230)
    * Fixed an issue where the automation hub would fail to upload collections due to a missing worker     temporary directory (AAP-44166)
    * Implemented a playbook to collect sos reports using the inventory file (AAP-42606)
    * Added new variable use_archive_compression with default value: true (AAP-41242)
    * Added new variables componentName_use_archive_compression for each component with the default value:
    true (AAP-41242)
    * containerized installer setup has been updated to 2.5-13

    RPM-based Ansible Automation Platform
    * Fixed issue where gateway services were not aligned after restore with the target environment     (AAP-44231)
    * Updated the installer to use ansible.platform collection (AAP-43465)
    * Fixed an issue activating rulebooks caused by missing Authorization header (AAP-44700)
    * Added compression for archive and database artifacts used in backup/restore (AAP-42055)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-12

    Additional changes:
    * aap-metrics-utility has been updated to 0.5.0
    * ansible-runner has been updated to 2.4.1
    * python3.11-dynaconf has been updated to 3.2.10
    * python3.11-sqlparse has been updated to 0.5.3

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3160 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Jinja sandbox breakout through attr filter selecting format method     (CVE-2025-27516)

    * python3.11-jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516)

    * python3.11-django: Potential denial-of-service vulnerability in django.utils.text.wrap()     (CVE-2025-26699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation Platform
    * Fixed an issue when migrating user accounts with invalid email addresses, the process would print a     message showing the user name of the user whose email address has been removed (AAP-42146)
    * When migrating user accounts with invalid email addresses the process will print a message showing the     user name of the user whose email address has been removed (AAP-41675)
    * automation-gateway has been updated to 2.5.20250326
    * python3.11-django-ansible-base has been updated to 2.5.20250326

    Automation controller
    * Fixed the host metrics to no longer collect host metrics for dark/unreachable hosts (AAP-41567)
    * Removed ANSIBLE_COLLECTIONS_PATHS from the controllers job output due to the discontinuation of     ansible-engine 2.9 (AAP-41566)
    * Fixed the system auditor to no longer download the execution node install bundle (AAP-37922)
    * Fixed host records to no longer be added to the HostMetric if the host had only failures or unreachable     tasks done (AAP-32094)
    * automation-controller has been updated to 4.6.10

    Automation hub
    * Fixed an issue where the user could not delete automation hub teams on the resource API (AAP-42158)
    * Added a migration file to set the default value of retain_repo_versions to 1 for validated repositories     (AAP-42005)
    * automation-hub has been updated to 4.10.3
    * python3.11-galaxy-ng has been updated to 4.10.3
    * python3.11-pulpcore has been updated to 3.49.34

    RPM-based Ansible Automation Platform
    * Fixed issue where preflight was not accounting for automationgateway being a CA server node (AAP-41817)
    * Fixed gateway installations which resulted in failures in environments with IPv6 due to nginx     configuration timing (AAP-41816)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-10

    Additional changes:
    * python3.11-django has been updated to 4.2.20
    * python3.11-jinja2 has been updated to 3.1.6

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:0959-1 advisory.

    - CVE-2025-26699: Fixed potential denial-of-service in django.utils.text.wrap() (bsc#1239052).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4086 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4086-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     March 19, 2025                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 2:2.2.28-1~deb11u6     CVE ID         : CVE-2025-26699     Debian Bug     : 1099682

    It was discovered that there was a potential denial-of-service (DoS)     vulnerability in Django, a Python-based web development framework.

    The issue was situated in the wrap() method of the django.utils.text     module. This method and the wordwrap template filter were subject to     a potential DoS attack when used with very long strings.

    For Debian 11 bullseye, this problem has been fixed in version     2:2.2.28-1~deb11u6.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-d58f8ec8ec advisory.

    ix for CVE-2025-26699: Potential denial-of-service vulnerability in django.utils.text.wrap()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-da3777e8c4 advisory.

    ix for CVE-2025-26699: Potential denial-of-service vulnerability in django.utils.text.wrap()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-9c039322cf advisory.

    Fix for CVE-2025-26699: Potential denial-of-service vulnerability in django.utils.text.wrap()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6f24ee84e8 advisory.

    Fix for CVE-2025-26699: Potential denial-of-service vulnerability in django.utils.text.wrap()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The     django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service     attack when used with very long strings. (CVE-2025-26699)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7335-1 advisory.

    It was discovered that Django incorrectly handled text wrapping. An attacker could possibly use this issue     to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
265369	GLSA-202509-03 : Django: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
241476	TencentOS Server 4: python-django (TSSA-2025:0501)	Nessus	Tencent Local Security Checks	high
237806	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2025:8609)	Nessus	Red Hat Local Security Checks	high
235381	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Moderate) (RHSA-2025:4553)	Nessus	Red Hat Local Security Checks	medium
233518	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2025:3160)	Nessus	Red Hat Local Security Checks	medium
233041	SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2025:0959-1)	Nessus	SuSE Local Security Checks	medium
232990	Debian dla-4086 : python-django-doc - security update	Nessus	Debian Local Security Checks	medium
232920	Fedora 40 : python-django4.2 (2025-d58f8ec8ec)	Nessus	Fedora Local Security Checks	medium
232917	Fedora 41 : python-django4.2 (2025-da3777e8c4)	Nessus	Fedora Local Security Checks	medium
232844	Fedora 40 : python-django (2025-9c039322cf)	Nessus	Fedora Local Security Checks	medium
232831	Fedora 41 : python-django (2025-6f24ee84e8)	Nessus	Fedora Local Security Checks	medium
232266	Linux Distros Unpatched Vulnerability : CVE-2025-26699	Nessus	Misc.	medium
232216	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Django vulnerability (USN-7335-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2025-26699

high

Tenable Plugins

critical

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium