An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 15, 2023 |
| Centos_linux | — | Upgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-hashieUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cliUpgrade rubygem-amazing_printUpgrade rubygem-version_gemUpgrade rubygem-unicode-debuginfoUpgrade rubygem-mime-types-dataUpgrade rubygem-unfUpgrade rubygem-highlineUpgrade rubygem-foreman_maintainUpgrade rubygem-jwtUpgrade rubygem-localeUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debuginfoUpgrade rubygem-oauthUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-apipie-bindingsUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-netrcUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-little-pluggerUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicodeUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debuginfoUpgrade python39-pulp_manifestUpgrade satellite-cloneUpgrade rubygem-unicode-debugsourceUpgrade satellite-maintain | May 4, 2023 | Feb 15, 2023 |
| Debian | — | Upgrade python-django | Feb 22, 2023 | Feb 15, 2023 |
| Freebsd | — | Upgrade py38-django40Upgrade py38-django41Upgrade py310-django41Upgrade py39-django32Upgrade py38-django32Upgrade py39-django41Upgrade py37-django32Upgrade py310-django32Upgrade py39-django40Upgrade py310-django40 | Feb 15, 2023 | Feb 14, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade python39-pulp_manifestUpgrade rubygem-foreman_maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unfUpgrade rubygem-unf_extUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-clampUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-http-cookieUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-oauthUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade satellite-maintainUpgrade rubygem-mime-types-dataUpgrade rubygem-netrcUpgrade rubygem-http-acceptUpgrade rubygem-amazing_printUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debuginfoUpgrade rubygem-apipie-bindingsUpgrade satellite-cloneUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-ffi-debugsourceUpgrade rubygem-localeUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-multi_jsonUpgrade rubygem-oauth-ttyUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-jwtUpgrade rubygem-gssapiUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cliUpgrade rubygem-unicode-debugsourceUpgrade rubygem-loggingUpgrade rubygem-little-plugger | May 4, 2023 | Feb 15, 2023 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Feb 15, 2023 |
| Suse | — | Upgrade python3-Django1Upgrade python3-django | Mar 1, 2023 | Feb 15, 2023 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Mar 22, 2023 | Feb 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub