Skip to content
OpenAdvisories
High · 7.5 CVE-2023-23969 BIT-django-2023-23969EUVD-2023-0066GHSA-q2jf-h9jm-m7p4PYSEC-2023-12

Django contains Uncontrolled Resource Consumption via cached header

Published Feb 1, 2023 · Updated Mar 27, 2025 · Assigned by mitre

Description

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 python-django 3:3.2.17-1 —
Debian 13 python-django 3:3.2.17-1 —
Debian 12 python-django 3:3.2.17-1 —
Debian 10 python-django 1:1.11.29-1+deb10u6 DLA-3306-1
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS python-django 2:3.2.12-2ubuntu1.4 USN-5837-1
Ubuntu 20.04 LTS python-django 2:2.2.12-1ubuntu0.15 USN-5837-1
Ubuntu 18.04 LTS python-django 1:1.11.11-1ubuntu1.19 USN-5837-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS python-django 1.8.7-1ubuntu5.15+esm6 USN-5837-2
Ubuntu Pro 14.04 LTS python-django No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite 3.9.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite_operations 1.3.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansible-lint 5.0.8-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 ansible-runner +1 2.2.1-3.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansiblerole-foreman_scap_client 0.2.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansiblerole-insights-client 1.7.1-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 cjson 1.7.14-5.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 createrepo_c +3 0.20.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 dynflow-utils 1.6.3-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman +1 3.5.1.14-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-bootloaders-redhat +1 202102220000-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-discovery-image 1:4.1.0-10.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-discovery-image-service +1 1.0.0-4.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-installer +1 1:3.5.2.1-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-proxy +1 3.5.1-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 katello +3 4.7.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 katello-certs-tools 2.9.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 katello-client-bootstrap 1.7.9-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 libcomps +2 0.1.18-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 libdb-cxx 5.3.28-42.el8_4 RHSA-2023:2097
Red Hat Satellite Capsule 6 libsodium 1.0.17-3.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 libsolv +2 0.7.22-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 libwebsockets 2.4.2-2.el8 RHSA-2023:2097
Red Hat Satellite Capsule 6 mosquitto 2.0.14-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 pulpcore-selinux 1.3.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 puppet-agent 7.12.1-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppet-agent-oauth 0.5.10-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppet-foreman_scap_client 0.4.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppetlabs-stdlib 5.2.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppetserver 7.9.3-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiodns +1 3.0.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiofiles +1 22.1.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiohttp +1 3.8.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiohttp-xmlrpc +1 1.5.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aioredis +1 2.0.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiosignal +1 1.2.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ansible-builder +1 1.0.1-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-asgiref +1 3.5.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-async-lru +1 1.0.3-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-async-timeout +1 4.0.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-asyncio-throttle +1 1.0.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-attrs +1 21.4.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-backoff +1 2.1.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bindep +1 2.11.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bleach +1 3.3.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bleach-allowlist +1 1.0.3-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bracex +1 2.2.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-brotli +1 1.0.9-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-cchardet +1 2.1.7-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-certifi +1 2020.6.20-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-cffi +1 1.15.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-chardet +1 5.0.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-charset-normalizer +1 2.1.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-click +1 8.1.3-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-click-shell +1 2.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-colorama +1 0.4.4-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-commonmark +1 0.9.1-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-contextlib2 +1 21.6.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-cryptography +1 3.4.8-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-daemon +1 2.3.1-1.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-dataclasses +1 0.8-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-dateutil +1 2.8.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-debian +1 0.1.43-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-defusedxml +1 0.7.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-deprecated +1 1.2.13-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-diff-match-patch +1 20200713-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-distro +1 1.7.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django +1 3.2.18-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-currentuser +1 0.5.3-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-filter +1 22.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-guid +1 3.3.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-import-export +1 2.8.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-lifecycle +1 1.0.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-djangorestframework +1 3.13.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-djangorestframework-queryfields +1 1.0.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-docutils +1 0.19-1.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-drf-access-policy +1 1.1.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-drf-nested-routers +1 0.93.4-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-drf-spectacular +1 0.23.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-dynaconf +1 3.1.9-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ecdsa +1 0.14.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-enrich +1 1.2.6-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-et-xmlfile +1 1.1.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-flake8 +1 3.9.2-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-frozenlist +1 1.3.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-future +1 0.18.2-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-galaxy-importer +1 0.4.5-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gitdb +1 4.0.9-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gitpython +1 3.1.26-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gnupg +1 0.5.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gunicorn +1 20.1.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-idna +1 3.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-idna-ssl +1 1.1.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-importlib-metadata +1 4.10.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-inflection +3 0.5.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-iniparse +1 0.4-35.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-jinja2 +1 3.1.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-jsonschema +1 4.9.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-lockfile +1 0.12.2-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-lxml +1 4.7.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-markdown +1 3.3.6-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-markuppy +1 1.14-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-markupsafe +1 2.0.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-mccabe +1 0.6.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-multidict +1 6.0.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-naya +3 1.1.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-odfpy +1 1.4.1-6.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-openpyxl +1 3.0.9-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-packaging +1 21.3-1.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-parsley +1 1.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pbr +1 5.8.0-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pexpect +1 4.8.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-productmd +1 1.33-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-protobuf +1 4.21.6-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-psycopg2 +1 2.9.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ptyprocess +1 0.7.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-ansible +1 1:0.15.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-certguard +1 1.5.5-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-cli +1 0.14.0-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-container +1 2.14.3-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-deb +1 2.20.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-file +1 1.11.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-rpm +1 3.18.11-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulpcore +1 3.21.6-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyOpenSSL +1 19.1.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycairo +1 1.20.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycares +1 4.1.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycodestyle +1 2.7.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycparser +1 2.21-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycryptodomex +1 3.14.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyflakes +1 2.3.1-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pygments +1 2.11.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pygobject +1 1:3.40.1-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pygtrie +1 2.5.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyjwkest +1 1.4.2-6.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyjwt +1 2.5.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyparsing +1 2.4.7-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyrsistent +1 0.18.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pytz +1 2022.2.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyyaml +1 5.4.1-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-qpid +1 1.37.0-1.el8 RHSA-2023:2097
Red Hat Satellite Capsule 6 python-redis +1 4.3.4-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-requests +1 2.28.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-requirements-parser +1 0.2.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-rhsm +1 1.19.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-rich +1 10.12.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ruamel-yaml +1 0.17.20-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ruamel-yaml-clib +1 0.2.6-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-schema +1 0.7.5-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-semantic-version +1 2.10.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-six +1 1.16.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-smmap +1 5.0.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-sqlparse +1 0.4.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-tablib +1 3.2.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-tenacity +1 7.0.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-toml +1 0.10.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-types-cryptography +1 3.3.23-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-typing-extensions +1 3.10.0.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-uritemplate +1 4.1.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-url-normalize +1 1.4.3-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-urllib3 +1 1.26.8-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-urlman +1 2.0.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-wcmatch +1 8.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-whitenoise +1 6.0.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-wrapt +1 1.14.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-xlrd +1 2.0.1-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-xlwt +1 1.3.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-yarl 1.7.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-zipp 3.4.0-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python2-qpid-qmf 1.39.0-7.el8amq RHSA-2023:2097
Red Hat Satellite Capsule 6 python2-saslwrapper 0.22-6.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python3-qpid-proton 0.33.0-4.el8 RHSA-2023:2097
Red Hat Rhui 4 python-django +1 3.2.18-1.0.1.el8ui RHSA-2023:2101
Red Hat Rhui 4 python-future +1 0.18.3-1.0.1.el8ui RHSA-2023:2101
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP5 python-Django 2.2.28-bp155.7.3.1 openSUSE-SU-2024:0251-1, openSUSE-SU-2023:0178-1
SUSE Package Hub 15 SP4 python-Django 2.2.28-bp154.2.6.1 openSUSE-SU-2023:0057-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-Django 4.1.6-1.1 openSUSE-SU-2025:14662-1, openSUSE-SU-2024:12654-1
openSUSE Tumbleweed python-Django4 4.2.14-1.1 openSUSE-SU-2026:11235-1, openSUSE-SU-2024:14208-1
openSUSE Tumbleweed python-Django5 5.2.16-1.1 openSUSE-SU-2026:11270-1
openSUSE Tumbleweed python-Django6 6.0-1.1 openSUSE-SU-2026:10005-1
openSUSE Leap 15.5 python-Django 2.0.7-150000.1.20.1 openSUSE-SU-2024:0251-1, openSUSE-SU-2023:0178-1, SUSE-SU-2024:2545-1
openSUSE Leap 15.4 python-Django 2.2.28-bp154.2.6.1 openSUSE-SU-2023:0057-1
ReleasePackageFixed inAdvisory
Alpine v3.24 py3-django 3.2.17-r0 —
Alpine v3.23 py3-django 3.2.17-r0 —
Alpine v3.22 py3-django 3.2.17-r0 —
Alpine v3.21 py3-django 3.2.17-r0 —
Alpine v3.20 py3-django 3.2.17-r0 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 py3-django 3.2.17-r0 —
Alpine v3.18 py3-django 3.2.17-r0 —
Alpine v3.17 py3-django 3.2.17-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI django >= 3.2a1, < 3.2.17 3.2.17 GHSA-q2jf-h9jm-m7p4
PyPI django >= 4.0a1, < 4.0.9 4.0.9 GHSA-q2jf-h9jm-m7p4
PyPI django >= 4.1a1, < 4.1.6 4.1.6 GHSA-q2jf-h9jm-m7p4
PyPI django >= 3.2, < 3.2.17 · >= 4.0, < 4.0.9 · >= 4.1, < 4.1.6 3.2.17, 4.0.9, 4.1.6 PYSEC-2023-12

Advisories 18

References