In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 1, 2023 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-snaky_hashUpgrade rubygem-oauth-ttyUpgrade rubygem-mime-typesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicodeUpgrade rubygem-unicode-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-little-pluggerUpgrade rubygem-loggingUpgrade rubygem-http-acceptUpgrade rubygem-gssapiUpgrade rubygem-ffi-debuginfoUpgrade rubygem-localeUpgrade rubygem-ffi-debugsourceUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-amazing_printUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-clampUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-http-cookieUpgrade rubygem-ffiUpgrade rubygem-unicode-display_widthUpgrade rubygem-foreman_maintainUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-version_gemUpgrade rubygem-unfUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foremanUpgrade python39-pulp_manifestUpgrade rubygem-hashieUpgrade satellite-maintainUpgrade rubygem-unf_extUpgrade rubygem-highlineUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-types-dataUpgrade satellite-cliUpgrade rubygem-rest-client | May 4, 2023 | Feb 1, 2023 |
| Debian | — | Upgrade python-django | Feb 3, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade py38-django40Upgrade py310-django41Upgrade py39-django41Upgrade py38-django41Upgrade py39-django32Upgrade py310-django40Upgrade py310-django32Upgrade py37-django32Upgrade py38-django32Upgrade py39-django40 | Feb 7, 2023 | Feb 6, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-unicode-debugsourceUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-mime-types-dataUpgrade rubygem-amazing_printUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-domain_nameUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-apipie-bindingsUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-little-pluggerUpgrade rubygem-loggingUpgrade rubygem-oauth-ttyUpgrade rubygem-http-acceptUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-typesUpgrade rubygem-ffi-debuginfoUpgrade rubygem-ffiUpgrade rubygem-fast_gettextUpgrade rubygem-snaky_hashUpgrade rubygem-unicode-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicodeUpgrade satellite-cliUpgrade rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cliUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade foreman-cliUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-netrcUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-foreman_maintainUpgrade python39-pulp_manifestUpgrade rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-gssapiUpgrade rubygem-hashieUpgrade rubygem-version_gemUpgrade rubygem-clamp | May 4, 2023 | Feb 1, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Feb 1, 2023 |
| Suse | — | Upgrade python3-django | Feb 22, 2023 | Feb 1, 2023 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-djangoUpgrade python-django (Ubuntu Pro)Upgrade python3-django (Ubuntu Pro) | Mar 22, 2023 | Feb 1, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub