Vulnerability advisory

CVE-2023-24580

Published Updated OSV record ↗

Also known as BIT-django-2023-24580GHSA-2hrw-hx67-34x6PYSEC-2023-13

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
3591e1c1acbd7c13174275367c3fdf012cb0413b to before 722e9f8a38f5b34f2423059a75f8a59bb8eb931a722e9f8a38f5b34f2423059a75f8a59bb8eb931a
ef62a3a68c9d558486145a42c0d71ea9a76add9e to before 4d51383f09870e3dade9967a60c956fb81b874a74d51383f09870e3dade9967a60c956fb81b874a7
9fee86e44dd83dc968ec443adcde191b3eba1286 to before c57ff9ba5e251cd4c2761105a6046662c08f951ec57ff9ba5e251cd4c2761105a6046662c08f951e

Description

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools