CVE-2011-4137
Status: ModifiedMedium (5)—
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.
CVSS
- Version: 2.0
- Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
- Base score: 5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 3.02%
- Percentile among all scored CVEs: 87
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-399
References
- http://openwall.com/lists/oss-security/2011/09/11/1
- http://openwall.com/lists/oss-security/2011/09/13/2
- http://openwall.com/lists/oss-security/2011/09/15/5
- http://secunia.com/advisories/46614
- http://www.debian.org/security/2011/dsa-2332
- https://bugzilla.redhat.com/show_bug.cgi?id=737366
- https://hermes.opensuse.org/messages/14700881
- https://www.djangoproject.com/weblog/2011/sep/09/
- https://www.djangoproject.com/weblog/2011/sep/10/127/
- http://openwall.com/lists/oss-security/2011/09/11/1
- http://openwall.com/lists/oss-security/2011/09/13/2
- http://openwall.com/lists/oss-security/2011/09/15/5
- http://secunia.com/advisories/46614
- http://www.debian.org/security/2011/dsa-2332
- https://bugzilla.redhat.com/show_bug.cgi?id=737366
- https://hermes.opensuse.org/messages/14700881
- https://www.djangoproject.com/weblog/2011/sep/09/
- https://www.djangoproject.com/weblog/2011/sep/10/127/
Raw JSON (NVD)
Show
{
"id": "CVE-2011-4137",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2011-10-19T10:55:04.207",
"references": [
{
"url": "http://openwall.com/lists/oss-security/2011/09/11/1",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://openwall.com/lists/oss-security/2011/09/13/2",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://openwall.com/lists/oss-security/2011/09/15/5",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/46614",
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2011/dsa-2332",
"source": "cve@mitre.org"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=737366",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "https://hermes.opensuse.org/messages/14700881",
"source": "cve@mitre.org"
},
{
"url": "https://www.djangoproject.com/weblog/2011/sep/09/",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.djangoproject.com/weblog/2011/sep/10/127/",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://openwall.com/lists/oss-security/2011/09/11/1",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://openwall.com/lists/oss-security/2011/09/13/2",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://openwall.com/lists/oss-security/2011/09/15/5",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/46614",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.debian.org/security/2011/dsa-2332",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=737366",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://hermes.opensuse.org/messages/14700881",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.djangoproject.com/weblog/2011/sep/09/",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.djangoproject.com/weblog/2011/sep/10/127/",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-399"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521."
},
{
"lang": "es",
"value": "La funcionalidad verify_exists de la implementación de URLField en Django en versiones anteriores a 1.2.7 y 1.3.x anteriores a 1.3.1 se basa en librerías Python que tratan de acceder a URLs arbitrarias sin un temporizador, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de todos los recursos) a través de una URL asociada con (1) una respuesta lenta, (2) una conexión TCP completa sin datos enviados o (3) una gran cantidad de datos de aplicación. Un problema relacionado con CVE-2011-1521."
}
],
"lastModified": "2026-06-16T23:34:29.663",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "96EC0AAD-1199-4CDB-B599-A7959A160CB6",
"versionEndIncluding": "1.2.6"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:0.91:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C40AD94B-AC89-4404-973F-5E60468D06EA"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:0.95:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "529CD787-1C98-4F20-8A3D-90BF2B0BD790"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:0.95.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65A952FB-3A74-4A39-8870-1F37059C9D12"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:0.96:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E79CFED-F8BF-48E7-897D-D1FB508DC9E1"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9023348-07A7-46E8-B45A-CC19563C5961"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "883C9BEA-8B02-42F7-90BB-F31CBCBF8B1E"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59302184-7805-4D50-B25C-73E59DAA1E66"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56846659-96C8-497C-8404-3975E5B6385B"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2DAB4639-B81D-412A-A081-EFF46737CA5D"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF068CD9-B33A-4C51-9FBA-CFDAE91E174E"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "26D338D9-1504-4933-B833-BD7F1864E89D"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD257D91-EF31-4103-9007-944603ABA271"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99387F31-9E04-4A73-A1C6-C05F96A8DB38"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.1:2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F75FE4BB-2C64-404F-9347-25289556BE56"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "064C9403-8A43-42C7-A1FD-03CC49A32FB1"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BCDB95B-88F2-466A-A4F9-4C080183E39B"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17B99C62-A653-45C1-A061-05A8FAD52107"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFA5071B-808F-490E-B407-37CD24ACCA47"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F5428AE-6B63-4D27-BCC4-F228264A6F0E"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.3:alpha1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06F122AC-B9BF-4E27-A7C0-F3E7B5E8A907"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.3:alpha2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF1504F2-968F-4E1A-A143-BE494E658DF0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}