Skip to content
OpenAdvisories
High USN-5837-1 1 CVE

python-django vulnerability

Published Feb 1, 2023 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Nick Pope discovered that Django incorrectly handled certain
Accept-Language headers. A remote attacker could possibly use this issue to
cause Django to consume memory, leading to a denial of service.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS python-django 1:1.11.11-1ubuntu1.19
Ubuntu · 20.04 LTS 20.04:LTS python-django 2:2.2.12-1ubuntu0.15
Ubuntu · 22.04 LTS 22.04:LTS python-django 2:3.2.12-2ubuntu1.4

Vulnerabilities 1

  • High 7.5
    CVE-2023-23969 EPSS 47%

    Django contains Uncontrolled Resource Consumption via cached header

    In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value o…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2023-23969