PT-2023-7986 · Django+5 · Django+5
Jakob Ackermann
·
Published
2023-02-14
·
Updated
2026-01-03
·
CVE-2023-24580
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 3.2 before 3.2.18
Django versions 4.0 before 4.0.10
Django versions 4.1 before 4.1.7
Description
The issue is related to an uncontrolled resource consumption in the Django web application platform. Exploitation of this issue could allow a remote attacker to cause a denial-of-service. The vulnerability is in the Multipart Request Parser, where passing certain inputs, such as an excessive number of parts to multipart forms, could result in too many open files or memory exhaustion, providing a potential vector for a denial-of-service attack.
Recommendations
For Django versions 3.2 before 3.2.18, update to version 3.2.18 or later.
For Django versions 4.0 before 4.0.10, update to version 4.0.10 or later.
For Django versions 4.1 before 4.1.7, update to version 4.1.7 or later.
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Django
Linuxmint
Rocky Linux
Ubuntu