Vulnerability advisory

PYSEC-2013-17

Published May 2, 2013Updated Jun 10, 2026OSV record ↗

Also known as CVE-2013-0306GHSA-g8xg-jgj6-49r3

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
`1.3` to before 1.3.6	`1.3.6`Advisories →
`1.4` to before 1.4.4	`1.4.4`Advisories →
Also listed as affected (10) `1.3` `1.3.1` `1.3.2` `1.3.3` `1.3.4` `1.3.5` `1.4` `1.4.1` `1.4.2` `1.4.3`

Description

The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.

References

ARTICLEwww.djangoproject.com/weblog/2013/feb/19/security/ ↗
Advisorywww.debian.org/security/2013/dsa-2634 ↗
Webubuntu.com/usn/usn-1757-1 ↗
Advisoryrhn.redhat.com/errata/RHSA-2013-0670.html ↗
Advisorygithub.com/advisories/GHSA-g8xg-jgj6-49r3 ↗