Vulnerability advisory

GHSA-2hrw-hx67-34x6

Resource exhaustion in Django

Published Feb 15, 2023Updated Mar 19, 2025OSV record ↗

Also known as BIT-django-2023-24580CVE-2023-24580PYSEC-2023-13

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
`3.2a1` to before 3.2.18	`3.2.18`Advisories →
Also listed as affected (21) `3.2` `3.2.1` `3.2.10` `3.2.11` `3.2.12` `3.2.13` `3.2.14` `3.2.15` `3.2.16` `3.2.17` `3.2.2` `3.2.3` `3.2.4` `3.2.5` `3.2.6` `3.2.7` `3.2.8` `3.2.9` `3.2a1` `3.2b1` `3.2rc1`
`4.1a1` to before 4.1.7	`4.1.7`Advisories →
Also listed as affected (10) `4.1` `4.1.1` `4.1.2` `4.1.3` `4.1.4` `4.1.5` `4.1.6` `4.1a1` `4.1b1` `4.1rc1`
`4.0a1` to before 4.0.10	`4.0.10`Advisories →
Also listed as affected (13) `4.0` `4.0.1` `4.0.2` `4.0.3` `4.0.4` `4.0.5` `4.0.6` `4.0.7` `4.0.8` `4.0.9` `4.0a1` `4.0b1` `4.0rc1`

Description

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

GHSA-2hrw-hx67-34x6

Affected versions

django PyPI

Description

References