In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 1, 2023 |
| Centos_linux | — | Upgrade python39-pulp_manifestUpgrade satellite-cliUpgrade satellite-maintainUpgrade rubygem-ffiUpgrade rubygem-hashieUpgrade rubygem-highlineUpgrade rubygem-unf_extUpgrade rubygem-powerbarUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-oauthUpgrade rubygem-netrcUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-rest-clientUpgrade rubygem-foreman_maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-unfUpgrade rubygem-domain_nameUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_tasksUpgrade foreman-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-types-dataUpgrade rubygem-gssapiUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-ffi-debuginfoUpgrade rubygem-amazing_printUpgrade rubygem-multi_jsonUpgrade rubygem-jwtUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-oauth-ttyUpgrade rubygem-unicodeUpgrade rubygem-unicode-debuginfoUpgrade rubygem-http-acceptUpgrade rubygem-ffi-debugsourceUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_templates | May 4, 2023 | Feb 1, 2023 |
| Debian | — | Upgrade python-django | Feb 3, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade py38-django40Upgrade py310-django41Upgrade py38-django41Upgrade py39-django41Upgrade py37-django32Upgrade py310-django40Upgrade py38-django32Upgrade py39-django40Upgrade py39-django32Upgrade py310-django32 | Feb 7, 2023 | Feb 6, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-multi_jsonUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-oauth-ttyUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-cloneUpgrade rubygem-http-acceptUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffiUpgrade rubygem-loggingUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-snaky_hashUpgrade rubygem-apipie-bindingsUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-little-pluggerUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade rubygem-fast_gettextUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-version_gemUpgrade python39-pulp_manifestUpgrade rubygem-gssapiUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-localeUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade foreman-cliUpgrade satellite-maintainUpgrade rubygem-oauthUpgrade rubygem-highlineUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cliUpgrade rubygem-rest-clientUpgrade rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_templates | May 4, 2023 | Feb 1, 2023 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Feb 1, 2023 |
| Suse | — | Upgrade python3-django | Feb 22, 2023 | Feb 1, 2023 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-djangoUpgrade python3-django (Ubuntu Pro)Upgrade python-django (Ubuntu Pro) | Mar 22, 2023 | Feb 1, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub