In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 1, 2023 |
| Centos_linux | — | Upgrade rubygem-amazing_printUpgrade rubygem-ffi-debuginfoUpgrade rubygem-localeUpgrade rubygem-unicodeUpgrade rubygem-multi_jsonUpgrade rubygem-jwtUpgrade rubygem-fast_gettextUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debuginfoUpgrade rubygem-oauth-ttyUpgrade rubygem-mime-typesUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-little-pluggerUpgrade satellite-cloneUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-apipie-bindingsUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-domain_nameUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade foreman-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-clampUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade rubygem-powerbarUpgrade rubygem-ffiUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-version_gemUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hashieUpgrade satellite-maintainUpgrade rubygem-unf_extUpgrade rubygem-http-cookieUpgrade rubygem-highlineUpgrade python39-pulp_manifest | May 4, 2023 | Feb 1, 2023 |
| Debian | — | Upgrade python-django | Feb 3, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade py37-django32Upgrade py310-django40Upgrade py39-django32Upgrade py310-django32Upgrade py38-django32Upgrade py39-django40Upgrade py38-django41Upgrade py310-django41Upgrade py38-django40Upgrade py39-django41 | Feb 7, 2023 | Feb 6, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hashieUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade foreman-cliUpgrade rubygem-unf_extUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-clampUpgrade rubygem-unicode-display_widthUpgrade rubygem-foreman_maintainUpgrade rubygem-netrcUpgrade python39-pulp_manifestUpgrade rubygem-http-cookieUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-powerbarUpgrade satellite-cloneUpgrade rubygem-ffi-debugsourceUpgrade rubygem-jwtUpgrade rubygem-unicode-debuginfoUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-snaky_hashUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicodeUpgrade rubygem-fast_gettextUpgrade rubygem-unfUpgrade rubygem-http-acceptUpgrade rubygem-domain_nameUpgrade rubygem-ffi-debuginfoUpgrade rubygem-loggingUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade rubygem-multi_jsonUpgrade rubygem-little-pluggerUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-amazing_printUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_google | May 4, 2023 | Feb 1, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Feb 1, 2023 |
| Suse | — | Upgrade python3-django | Feb 22, 2023 | Feb 1, 2023 |
| Ubuntu | — | Upgrade python-django (Ubuntu Pro)Upgrade python3-django (Ubuntu Pro)Upgrade python-djangoUpgrade python3-django | Mar 22, 2023 | Feb 1, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub