In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 1, 2023 |
| Centos_linux | — | Upgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicodeUpgrade rubygem-http-acceptUpgrade rubygem-loggingUpgrade rubygem-ffi-debugsourceUpgrade rubygem-little-pluggerUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-snaky_hashUpgrade rubygem-oauth-ttyUpgrade rubygem-ffi-debuginfoUpgrade rubygem-localeUpgrade rubygem-amazing_printUpgrade rubygem-gssapiUpgrade rubygem-apipie-bindingsUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cliUpgrade rubygem-mime-typesUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-domain_nameUpgrade python39-pulp_manifestUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hashieUpgrade satellite-maintainUpgrade rubygem-unf_extUpgrade rubygem-rest-clientUpgrade rubygem-powerbarUpgrade rubygem-ffiUpgrade rubygem-mime-types-dataUpgrade satellite-cliUpgrade rubygem-http-cookieUpgrade rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade rubygem-clampUpgrade rubygem-unfUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-version_gemUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade foreman-cli | May 4, 2023 | Feb 1, 2023 |
| Debian | — | Upgrade python-django | Feb 3, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade py38-django41Upgrade py38-django40Upgrade py39-django41Upgrade py310-django41Upgrade py39-django32Upgrade py39-django40Upgrade py310-django40Upgrade py38-django32Upgrade py310-django32Upgrade py37-django32 | Feb 7, 2023 | Feb 6, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-http-cookieUpgrade rubygem-version_gemUpgrade rubygem-gssapiUpgrade rubygem-unf_extUpgrade rubygem-highlineUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_templatesUpgrade foreman-cliUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-oauthUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-localeUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade rubygem-netrcUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-acceptUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-mime-typesUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicodeUpgrade rubygem-ffi-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-ffi-debuginfoUpgrade rubygem-domain_nameUpgrade rubygem-loggingUpgrade satellite-cloneUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-oauth-ttyUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cliUpgrade rubygem-jwt | May 4, 2023 | Feb 1, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfo | Mar 12, 2024 | Feb 1, 2023 |
| Suse | — | Upgrade python3-django | Feb 22, 2023 | Feb 1, 2023 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-djangoUpgrade python3-django (Ubuntu Pro)Upgrade python-django (Ubuntu Pro) | Mar 22, 2023 | Feb 1, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub