GitHub Advisoryadvisory · PyPI

GHSA-7h4p-27mh-hmrw Django Denial of service vulnerability in django.utils.encoding.uri_to_iri

MEDIUM Published 2023-11-03 Modified 2025-11-04 Official page ↗
Aliases
CVE-2023-41164
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1284, CWE-400
Reviewed
2023-11-03

Affected packages

• PyPI Django: >= 3.2, < 3.2.21 → fixed in 3.2.21 • PyPI Django: >= 4.1, < 4.1.11 → fixed in 4.1.11 • PyPI Django: >= 4.2, < 4.2.5 → fixed in 4.2.5

Description

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

Related

Alias · CVE (1)

  • CVE-2023-41164 In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS… vulnerability

Weakness · CWE (2)

  • CWE-1284 Improper Validation of Specified Quantity in Input weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References