CVE-2024-23826: Python Secure Filename Dos Missing Length Check
Passing an unbounded string to `secure_filename()` can cause a Denial of Service (DoS) on Windows due to the expensive NFKD Unicode normalization loop. Verify the length of the string before calling `secure_filename()`, or slice the string to a safe length (e.g. `filename[:255]`).
Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0python
greprules fetch cve-2024-23826-python-secure-filename-dos-missing-length-check --engine opengrepDescription
Passing an unbounded string to `secure_filename()` can cause a Denial of Service (DoS) on Windows due to the expensive NFKD Unicode normalization loop. Verify the length of the string before calling `secure_filename()`, or slice the string to a safe length (e.g. `filename[:255]`).
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.