An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 15, 2023 |
| Centos_linux | — | Upgrade rubygem-loggingUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cliUpgrade rubygem-unicodeUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-mime-typesUpgrade satellite-cloneUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_katelloUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-oauth-ttyUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-domain_nameUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffiUpgrade rubygem-multi_jsonUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicode-debugsourceUpgrade rubygem-http-acceptUpgrade rubygem-netrcUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsourceUpgrade foreman-cliUpgrade rubygem-foreman_maintainUpgrade rubygem-unfUpgrade rubygem-amazing_printUpgrade rubygem-hashieUpgrade rubygem-snaky_hashUpgrade rubygem-localeUpgrade rubygem-mime-types-dataUpgrade rubygem-fast_gettextUpgrade rubygem-unicode-debuginfoUpgrade rubygem-gssapiUpgrade rubygem-version_gemUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-ffi-debuginfoUpgrade rubygem-jwtUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-highline | May 4, 2023 | Feb 15, 2023 |
| Debian | — | Upgrade python-django | Feb 22, 2023 | Feb 15, 2023 |
| Freebsd | — | Upgrade py310-django40Upgrade py310-django32Upgrade py37-django32Upgrade py38-django32Upgrade py39-django41Upgrade py39-django40Upgrade py39-django32Upgrade py38-django40Upgrade py310-django41Upgrade py38-django41 | Feb 15, 2023 | Feb 14, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicode-debuginfoUpgrade rubygem-ffi-debuginfoUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicodeUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-snaky_hashUpgrade rubygem-jwtUpgrade rubygem-localeUpgrade rubygem-ffi-debugsourceUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-typesUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debugsourceUpgrade rubygem-fast_gettextUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cliUpgrade rubygem-gssapiUpgrade rubygem-amazing_printUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade python39-pulp_manifestUpgrade satellite-cliUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unfUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_extUpgrade rubygem-http-cookieUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-domain_nameUpgrade rubygem-ffiUpgrade rubygem-mime-types-dataUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-display_widthUpgrade satellite-maintainUpgrade rubygem-version_gemUpgrade rubygem-highlineUpgrade rubygem-netrc | May 4, 2023 | Feb 15, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Feb 15, 2023 |
| Suse | — | Upgrade python3-Django1Upgrade python3-django | Mar 1, 2023 | Feb 15, 2023 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django | Mar 22, 2023 | Feb 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub