Allocation of Resources Without Limits or Throttling

Summary

An issue was discovered in Django 4.2.x prior to 4.2.18, 5.0.x prior to 5.0.11, and 5.1.x prior to 5.1.5. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions `clean_ipv6_address` and `is_valid_ipv6_address` are vulnerable, as is the `django.forms.GenericIPAddressField` form field. (The `django.db.models.GenericIPAddressField` model field is not affected.)