An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 15, 2023 |
| Centos_linux | — | Upgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-hashieUpgrade rubygem-version_gemUpgrade rubygem-snaky_hashUpgrade rubygem-gssapiUpgrade rubygem-localeUpgrade foreman-cliUpgrade rubygem-fast_gettextUpgrade rubygem-rest-clientUpgrade rubygem-mime-types-dataUpgrade rubygem-amazing_printUpgrade rubygem-jwtUpgrade rubygem-clampUpgrade rubygem-ffi-debugsourceUpgrade rubygem-ffi-debuginfoUpgrade rubygem-foreman_maintainUpgrade rubygem-oauthUpgrade rubygem-unfUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-http-acceptUpgrade rubygem-ffiUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_adminUpgrade python39-pulp_manifestUpgrade satellite-cloneUpgrade rubygem-powerbarUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-debugsourceUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicodeUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_extUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-oauth-tty | May 4, 2023 | Feb 15, 2023 |
| Debian | — | Upgrade python-django | Feb 22, 2023 | Feb 15, 2023 |
| Freebsd | — | Upgrade py310-django40Upgrade py310-django32Upgrade py37-django32Upgrade py39-django41Upgrade py38-django32Upgrade py39-django40Upgrade py39-django32Upgrade py38-django41Upgrade py310-django41Upgrade py38-django40 | Feb 15, 2023 | Feb 14, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unfUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-domain_nameUpgrade satellite-cliUpgrade python39-pulp_manifestUpgrade rubygem-version_gemUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade foreman-cliUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_extUpgrade rubygem-ffiUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-powerbarUpgrade rubygem-hashieUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-localeUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-fast_gettextUpgrade rubygem-multi_jsonUpgrade rubygem-gssapiUpgrade rubygem-apipie-bindingsUpgrade rubygem-little-pluggerUpgrade rubygem-mime-typesUpgrade rubygem-http-acceptUpgrade rubygem-oauth-ttyUpgrade rubygem-unicodeUpgrade rubygem-ffi-debugsourceUpgrade rubygem-jwtUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debuginfoUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debuginfo | May 4, 2023 | Feb 15, 2023 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Feb 15, 2023 |
| Suse | — | Upgrade python3-djangoUpgrade python3-Django1 | Mar 1, 2023 | Feb 15, 2023 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Mar 22, 2023 | Feb 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub