In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 1, 2023 |
| Centos_linux | — | Upgrade rubygem-netrcUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-foreman_maintainUpgrade rubygem-oauthUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hashieUpgrade rubygem-domain_nameUpgrade rubygem-clampUpgrade foreman-cliUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-types-dataUpgrade satellite-cliUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade python39-pulp_manifestUpgrade rubygem-unf_extUpgrade satellite-maintainUpgrade rubygem-rest-clientUpgrade rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cliUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debugsourceUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-ffi-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-debugsourceUpgrade rubygem-snaky_hash | May 4, 2023 | Feb 1, 2023 |
| Debian | — | Upgrade python-django | Feb 3, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade py310-django32Upgrade py38-django32Upgrade py37-django32Upgrade py39-django40Upgrade py39-django32Upgrade py310-django40Upgrade py38-django40Upgrade py38-django41Upgrade py310-django41Upgrade py39-django41 | Feb 7, 2023 | Feb 6, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-unicode-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-unicodeUpgrade rubygem-unicode-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debuginfoUpgrade rubygem-ffiUpgrade satellite-cloneUpgrade rubygem-multi_jsonUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-oauth-ttyUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-apipie-bindingsUpgrade rubygem-jwtUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-loggingUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade satellite-maintainUpgrade python39-pulp_manifestUpgrade rubygem-powerbarUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foremanUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-foreman_maintainUpgrade rubygem-hashieUpgrade rubygem-gssapiUpgrade rubygem-http-cookieUpgrade rubygem-unicode-display_widthUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_extUpgrade rubygem-localeUpgrade rubygem-clampUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highline | May 4, 2023 | Feb 1, 2023 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfo | Mar 12, 2024 | Feb 1, 2023 |
| Suse | — | Upgrade python3-django | Feb 22, 2023 | Feb 1, 2023 |
| Ubuntu | — | Upgrade python-django (Ubuntu Pro)Upgrade python3-django (Ubuntu Pro)Upgrade python-djangoUpgrade python3-django | Mar 22, 2023 | Feb 1, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub