~ / search / GHSA-2hrw-hx67-34x6

GHSA-2hrw-hx67-34x6

Resource exhaustion in Django

Source: GitHub Advisory Database (reviewed) High CVE-2023-24580

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 3.2a1, < 3.2.18 3.2.18
PyPI Django >= 4.1a1, < 4.1.7 4.1.7
PyPI Django >= 4.0a1, < 4.0.10 4.0.10

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

References

External links from the advisory. They lead to third-party sites.