| Package | Affected versions | Patched versions |
|---|---|---|
| django | ≥ 3.2, < 3.2.17≥ 3.2a1, < 3.2.17≥ 4.0, < 4.0.9≥ 4.0a1, < 4.0.9≥ 4.1, < 4.1.6≥ 4.1a1, < 4.1.6 | 3.2.174.0.94.1.6 |
| django | ≥ 3.2, < 3.2.17≥ 4.0, < 4.0.9≥ 4.1, < 4.1.6 | 3.2.174.0.94.1.6 |
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free