CVE-2013-0306: Django is vulnerable to Denial of Service… – CVSS 5.0 · Watchpost

← All vulnerabilities

Django is vulnerable to Denial of Service attack in formset

MEDIUM 5.0CVE-2013-0306 · GHSA-g8xg-jgj6-49r3 · PYSEC-2013-17 · Published 02/05/2013 · updated 16/06/2026

In short

CVE-2013-0306 is a MEDIUM (CVSS 5.0) vulnerability affecting django, django (djangoproject).
Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.3% of all vulnerabilities.
Fix: update to 1.3.6, 1.4.4 or later.

Package	Affected versions	Patched versions
django PyPI	`≥ 1.3, < 1.3.6≥ 1.4, < 1.4.4`	`1.3.61.4.4`
django djangoproject	`= 1.3= 1.3.1= 1.3.2= 1.3.3= 1.4= 1.4.1= 1.4.2= 1.5`	No fix yet

Description

The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.

NVD description

The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.

References

nvd.nist.gov/vuln/detail/CVE-2013-0306 · ADVISORY
django/django commit 0cc350a · WEB
django/django commit d7094bb · WEB
django/django · PACKAGE
pypa/advisory-database · WEB
djangoproject.com/weblog/2013/feb/19/security · WEB
rhn.redhat.com/errata/RHSA-2013-0670.html · WEB
ubuntu.com/usn/usn-1757-1 · WEB
debian.org/security/2013/dsa-2634 · WEB
djangoproject.com/weblog/2013/feb/19/security · Vendor Advisory
GitHub Advisory GHSA-g8xg-jgj6-49r3 · ADVISORY

More vulnerabilities in django

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free