In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 1, 2023 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debuginfoUpgrade satellite-cloneUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicodeUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-multi_jsonUpgrade rubygem-gssapiUpgrade rubygem-ffi-debuginfoUpgrade rubygem-jwtUpgrade rubygem-localeUpgrade rubygem-hammer_cliUpgrade rubygem-loggingUpgrade rubygem-ffi-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-little-pluggerUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-mime-typesUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-debugsourceUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade satellite-maintainUpgrade rubygem-oauthUpgrade rubygem-domain_nameUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade python39-pulp_manifestUpgrade rubygem-hashieUpgrade rubygem-unf_extUpgrade rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unfUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-version_gemUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-foreman_maintainUpgrade rubygem-http-cookieUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade rubygem-powerbarUpgrade rubygem-ffiUpgrade satellite-cli | May 4, 2023 | Feb 1, 2023 |
| Debian | — | Upgrade python-django | Feb 3, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade py38-django32Upgrade py310-django32Upgrade py37-django32Upgrade py39-django32Upgrade py310-django40Upgrade py39-django40Upgrade py38-django41Upgrade py39-django41Upgrade py310-django41Upgrade py38-django40 | Feb 7, 2023 | Feb 6, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-version_gemUpgrade rubygem-gssapiUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cliUpgrade satellite-maintainUpgrade foreman-cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-oauthUpgrade rubygem-netrcUpgrade rubygem-powerbarUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-localeUpgrade rubygem-highlineUpgrade rubygem-unf_extUpgrade rubygem-jwtUpgrade rubygem-loggingUpgrade rubygem-domain_nameUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-acceptUpgrade satellite-cloneUpgrade rubygem-fast_gettextUpgrade rubygem-ffiUpgrade rubygem-ffi-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-oauth-ttyUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-little-pluggerUpgrade rubygem-mime-typesUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicodeUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_bootdisk | May 4, 2023 | Feb 1, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Feb 1, 2023 |
| Suse | — | Upgrade python3-django | Feb 22, 2023 | Feb 1, 2023 |
| Ubuntu | — | Upgrade python3-django (Ubuntu Pro)Upgrade python-django (Ubuntu Pro)Upgrade python3-djangoUpgrade python-django | Mar 22, 2023 | Feb 1, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub