CVEvulnerability
CVE-2023-24580
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-02-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
Description
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
Affected configurations
• djangoproject django (>= 3.2 < 3.2.18)
• djangoproject django (>= 4.0 < 4.0.10)
• djangoproject django (>= 4.1 < 4.1.7)
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- http://www.openwall.com/lists/oss-security/2023/02/14/1 Mailing List, Release Notes, Third Party Advisory
- https://docs.djangoproject.com/en/4.1/releases/security/ Patch, Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce groups.google.com
- https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20230316-0006/ security.netapp.com
- https://www.djangoproject.com/weblog/2023/feb/14/security-releases/ Patch, Release Notes, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/02/14/1 Mailing List, Release Notes, Third Party Advisory
- https://docs.djangoproject.com/en/4.1/releases/security/ Patch, Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce groups.google.com
- https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20230316-0006/ security.netapp.com
- https://www.djangoproject.com/weblog/2023/feb/14/security-releases/ Patch, Release Notes, Vendor Advisory