An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 15, 2023 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_foremanUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-loggingUpgrade satellite-maintainUpgrade rubygem-mime-typesUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cliUpgrade rubygem-unicode-display_widthUpgrade satellite-cloneUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-http-cookieUpgrade rubygem-little-pluggerUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-apipie-bindingsUpgrade rubygem-multi_jsonUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-acceptUpgrade rubygem-netrcUpgrade rubygem-unicodeUpgrade rubygem-domain_nameUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_openscapUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-clampUpgrade rubygem-foreman_maintainUpgrade rubygem-ffi-debuginfoUpgrade rubygem-highlineUpgrade rubygem-hammer_cliUpgrade rubygem-mime-types-dataUpgrade rubygem-version_gemUpgrade rubygem-unicode-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debugsourceUpgrade rubygem-localeUpgrade rubygem-snaky_hashUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade rubygem-jwtUpgrade rubygem-oauthUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-amazing_print | May 4, 2023 | Feb 15, 2023 |
| Debian | — | Upgrade python-django | Feb 22, 2023 | Feb 15, 2023 |
| Freebsd | — | Upgrade py38-django32Upgrade py37-django32Upgrade py39-django41Upgrade py310-django40Upgrade py39-django40Upgrade py310-django32Upgrade py310-django41Upgrade py39-django32Upgrade py38-django40Upgrade py38-django41 | Feb 15, 2023 | Feb 14, 2023 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-gssapiUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-acceptUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debugsourceUpgrade rubygem-jwtUpgrade rubygem-unicodeUpgrade satellite-cloneUpgrade rubygem-hammer_cliUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-oauth-ttyUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-localeUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-oauthUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hashieUpgrade satellite-maintainUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffiUpgrade foreman-cliUpgrade rubygem-unfUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-domain_nameUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_extUpgrade rubygem-http-cookieUpgrade python39-pulp_manifestUpgrade rubygem-rest-clientUpgrade rubygem-netrcUpgrade satellite-cliUpgrade rubygem-highlineUpgrade rubygem-version_gem | May 4, 2023 | Feb 15, 2023 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Feb 15, 2023 |
| Suse | — | Upgrade python3-Django1Upgrade python3-django | Mar 1, 2023 | Feb 15, 2023 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Mar 22, 2023 | Feb 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub