cve.bz

CVE-2023-24580

7.5 highEPSS 63%

High (7.5). EPSS 63% chance of exploitation in the next 30 days. Fixed in django 3.2.18, 4.0.10, 4.1.7.

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
63% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-400
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2hrw-hx67-34x6PyPIdjango>=3.2a1 <3.2.183.2.18
GHSA-2hrw-hx67-34x6PyPIdjango>=4.1a1 <4.1.74.1.7
GHSA-2hrw-hx67-34x6PyPIdjango>=4.0a1 <4.0.104.0.10
PYSEC-2023-13PyPIdjango>=3.2 <3.2.18
>=4.0 <4.0.10
>=4.1 <4.1.7		3.2.18, 4.0.10, 4.1.7

References

Check your stackJSON