{"action":"Upgrade django to 3.2.22 or later.","affected":[{"fixed":"3.2.22","introduced":"3.2"},{"fixed":"4.1.12","introduced":"4.1"},{"fixed":"4.2.6","introduced":"4.2"}],"component":"django","cve_ids":["CVE-2023-43665"],"ecosystem":"PyPI","epss":0.01462,"exploited":false,"fixed_versions":["3.2.22","4.1.12","4.2.6"],"ghsa_id":"GHSA-h8gc-pgj2-vjm3","id":"tcs_01M5KGK03ZNNFJSNVQ8FB12X2H","modified_at":"2026-06-10T17:01:03.986909758Z","published_at":"2023-11-03T05:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-226","https://www.djangoproject.com/weblog/2023/oct/04/security-releases/","https://docs.djangoproject.com/en/4.2/releases/security/","https://groups.google.com/forum/#!forum/django-announce","https://github.com/advisories/GHSA-h8gc-pgj2-vjm3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-226","url":"https://osv.dev/vulnerability/PYSEC-2023-226"}],"summary":"In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of s"}