~ / search / GHSA-33mw-q7rj-mjwj

GHSA-33mw-q7rj-mjwj

Django has Inefficient Algorithmic Complexity

Source: GitHub Advisory Database (reviewed) Low CVE-2025-14550

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 6.0a1, < 6.0.2 6.0.2
PyPI Django >= 5.2a1, < 5.2.11 5.2.11
PyPI Django >= 4.2a1, < 4.2.28 4.2.28

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.

References

External links from the advisory. They lead to third-party sites.