NetSight
IP …
high7.5

CVE-2023-24580

Resource exhaustion in Django

Impact

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Affected packages

EcosystemPackageAffectedFixed in
pipDjango>= 3.2a1, < 3.2.183.2.18

Affected products

VendorProductAffected versions
DjangoprojectDjango
from 3.2 before 3.2.18
from 4.0 before 4.0.10
from 4.1 before 4.1.7
DebianDebian Linux
Version 10.0

Weakness classification

CWE-400

References