In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 1, 2023 |
| Centos_linux | — | Upgrade rubygem-highlineUpgrade rubygem-unf_extUpgrade satellite-maintainUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_tasksUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-oauthUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-netrcUpgrade rubygem-domain_nameUpgrade rubygem-version_gemUpgrade rubygem-hashieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-foreman_maintainUpgrade satellite-cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-ffiUpgrade rubygem-powerbarUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-loggingUpgrade rubygem-hammer_cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-gssapiUpgrade rubygem-apipie-bindingsUpgrade satellite-cloneUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-oauth-ttyUpgrade rubygem-snaky_hashUpgrade rubygem-unicodeUpgrade rubygem-http-acceptUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade rubygem-ffi-debuginfoUpgrade rubygem-amazing_printUpgrade rubygem-multi_jsonUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_remote_execution | May 4, 2023 | Feb 1, 2023 |
| Debian | — | Upgrade python-django | Feb 3, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade py39-django32Upgrade py310-django40Upgrade py310-django32Upgrade py38-django32Upgrade py37-django32Upgrade py39-django40Upgrade py38-django41Upgrade py39-django41Upgrade py310-django41Upgrade py38-django40 | Feb 7, 2023 | Feb 6, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-oauth-ttyUpgrade rubygem-mime-types-dataUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-little-pluggerUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-mime-typesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-ffiUpgrade rubygem-unicodeUpgrade rubygem-ffi-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cliUpgrade rubygem-fast_gettextUpgrade rubygem-jwtUpgrade rubygem-unfUpgrade rubygem-loggingUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_extUpgrade rubygem-clampUpgrade rubygem-highlineUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-netrcUpgrade rubygem-foreman_maintainUpgrade rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade rubygem-gssapiUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-version_gemUpgrade rubygem-hashieUpgrade rubygem-http-cookieUpgrade python39-pulp_manifestUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_ansible | May 4, 2023 | Feb 1, 2023 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Feb 1, 2023 |
| Suse | — | Upgrade python3-django | Feb 22, 2023 | Feb 1, 2023 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-djangoUpgrade python3-django (Ubuntu Pro)Upgrade python-django (Ubuntu Pro) | Mar 22, 2023 | Feb 1, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub