In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 1, 2023 |
| Centos_linux | — | Upgrade rubygem-highlineUpgrade satellite-maintainUpgrade rubygem-hashieUpgrade rubygem-unf_extUpgrade rubygem-netrcUpgrade rubygem-unfUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-powerbarUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-types-dataUpgrade rubygem-clampUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-oauthUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-display_widthUpgrade rubygem-domain_nameUpgrade rubygem-foreman_maintainUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cliUpgrade rubygem-gssapiUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-fast_gettextUpgrade rubygem-multi_jsonUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-amazing_printUpgrade rubygem-snaky_hashUpgrade rubygem-mime-typesUpgrade rubygem-oauth-tty | May 4, 2023 | Feb 1, 2023 |
| Debian | — | Upgrade python-django | Feb 3, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade py310-django41Upgrade py38-django41Upgrade py38-django40Upgrade py39-django41Upgrade py39-django40Upgrade py37-django32Upgrade py39-django32Upgrade py38-django32Upgrade py310-django32Upgrade py310-django40 | Feb 7, 2023 | Feb 6, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hashieUpgrade rubygem-gssapiUpgrade rubygem-version_gemUpgrade python39-pulp_manifestUpgrade rubygem-http-cookieUpgrade rubygem-unf_extUpgrade rubygem-unicode-display_widthUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-localeUpgrade rubygem-clampUpgrade rubygem-netrcUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade foreman-cliUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-oauthUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-powerbarUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-fast_gettextUpgrade rubygem-unicodeUpgrade rubygem-little-pluggerUpgrade rubygem-apipie-bindingsUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffiUpgrade satellite-cloneUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-oauth-ttyUpgrade rubygem-loggingUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-ffi-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_execution | May 4, 2023 | Feb 1, 2023 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Feb 1, 2023 |
| Suse | — | Upgrade python3-django | Feb 22, 2023 | Feb 1, 2023 |
| Ubuntu | — | Upgrade python-django (Ubuntu Pro)Upgrade python3-django (Ubuntu Pro)Upgrade python3-djangoUpgrade python-django | Mar 22, 2023 | Feb 1, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub