An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Feb 10, 2026 | Feb 3, 2026 |
| Debian | — | Upgrade python-django | Mar 2, 2026 | Mar 2, 2026 |
| Redhat_linux | — | Upgrade python3.12-django-ansible-base+oauth2_providerUpgrade python3.12-dynaconfUpgrade python3-wheel-wheelUpgrade python3.12-cffiUpgrade ansible-coreUpgrade python3.12-cffi-debugsourceUpgrade receptor-debugsourceUpgrade python3-blackUpgrade python3.12-django-ansible-base+authenticationUpgrade python3.12-pysequoiaUpgrade python3.12-pyjwt+cryptoUpgrade python3.12-galaxy-ngUpgrade python3.12-pulp-containerUpgrade automation-controller-uiUpgrade python3-pathspecUpgrade python3.12-pyasn1-modulesUpgrade ansible-testUpgrade python3.12-cryptographyUpgrade python3.12-pytokens-debuginfoUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-gatewayUpgrade python3.12-pyjwtUpgrade python3-pytokens-debuginfoUpgrade python3.12-galaxy-importerUpgrade automation-hubUpgrade python3.12-pysequoia-debugsourceUpgrade python3.12-pyOpenSSLUpgrade automation-eda-controller-baseUpgrade automation-eda-controller-worker-servicesUpgrade receptorctlUpgrade automation-gateway-serverUpgrade python3.12-pulpcoreUpgrade python3.12-pysequoia-debuginfoUpgrade automation-controller-venv-towerUpgrade python3.12-django-ansible-base+redis_clientUpgrade python3.12-django-ansible-base+channel_authUpgrade automation-gateway-proxy-debugsourceUpgrade python3.12-django-ansible-base+api_documentationUpgrade python3-pytokensUpgrade receptor-debuginfoUpgrade automation-platform-uiUpgrade python3.12-jwcryptoUpgrade automation-eda-controller-event-stream-servicesUpgrade python3.12-pyasn1Upgrade automation-eda-controllerUpgrade python3.12-blackUpgrade python3.12-django-ansible-base+rbacUpgrade python3.12-cryptography-debuginfoUpgrade automation-gateway-proxyUpgrade automation-eda-controller-base-servicesUpgrade automation-gateway-proxy-serverUpgrade python-pytokens-debugsourceUpgrade automation-controller-cliUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-django-ansible-base+feature_flagsUpgrade automation-gateway-proxy-server-debuginfoUpgrade python3.12-cffi-debuginfoUpgrade automation-gateway-configUpgrade python3.12-cryptography-debugsourceUpgrade python3.12-pytokens-debugsourceUpgrade automation-controller-serverUpgrade yamllintUpgrade python3.12-pathspecUpgrade python3.12-pytokensUpgrade receptorUpgrade python3.12-markdownUpgrade automation-controllerUpgrade python3.12-django-ansible-base+resource_registryUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-django-ansible-baseUpgrade ansible-lint | May 6, 2026 | Feb 3, 2026 |
| Ubuntu | — | Upgrade python-django (Ubuntu Pro)Upgrade python3-django (Ubuntu Pro)Upgrade python3-django | Feb 4, 2026 | Feb 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub