An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0…
Priority HIGH 74CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.62575 99th percentileScored 2026-11-07
Fix Partial Django (PyPI): 3.2.18, 4.1.7, 4.0.10Red Hat: 3 advisoriesRed Hat: 4 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 3.2a1 to before 3.2.18 | 3.2.18 | Patch available | GHSA-2hrw-hx67-34x6 |
| — | Django (PyPI) | 4.1a1 to before 4.1.7 | 4.1.7 | Patch available | GHSA-2hrw-hx67-34x6 |
| — | Django (PyPI) | 4.0a1 to before 4.0.10 | 4.0.10 | Patch available | GHSA-2hrw-hx67-34x6 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 3.2a1 to before 3.2.18 Fixed in 3.2.18 Patch available GHSA-2hrw-hx67-34x6
- Django (PyPI) Vendor— Affected 4.1a1 to before 4.1.7 Fixed in 4.1.7 Patch available GHSA-2hrw-hx67-34x6
- Django (PyPI) Vendor— Affected 4.0a1 to before 4.0.10 Fixed in 4.0.10 Patch available GHSA-2hrw-hx67-34x6
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | 3.2 to before 3.2.18; 4.0 to before 4.0.10; 4.1 to before 4.1.7 | Vulnerable | djangoproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 3.2 to before 3.2.18; 4.0 to before 4.0.10; 4.1 to before 4.1.7 Vulnerable ·djangoproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-2hrw-hx67-34x6 Django (PyPI) Fixed in 3.2.18 Advisory →
- Fix · GHSA-2hrw-hx67-34x6 Django (PyPI) Fixed in 4.1.7 Advisory →
- Fix · GHSA-2hrw-hx67-34x6 Django (PyPI) Fixed in 4.0.10 Advisory →
Red Hat 3 advisories
- RHSA-2023:4692 Released 2023-08-21 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-4.4.2-1.el8ap, automation-controller-venv-tower-4.4.2-1.el8ap
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-4.4.2-1.el9ap, automation-controller-venv-tower-4.4.2-1.el9ap
- RHSA-2023:2097 Released 2023-05-03 · Red Hat rating ImportantSatellite 6.13 Release
- Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47
- RHSA-2023:2101 Released 2023-05-03 · Red Hat rating ModerateRHUI 4.4.0 release - Security Fixes, Bug Fixes, and Enhancements Update
- RHUI 4 for RHEL 8 python-django-3.2.18-1.0.1.el8ui, python-future-0.18.3-1.0.1.el8ui, python39-django-3.2.18-1.0.1.el8ui +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Discovery 1 | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.0 | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix planned: Out of support scope |
| RHUI 4 for RHEL 8 | Fixed | RHSA-2023:2101 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2023:4692 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2023:4692 |
| Red Hat Satellite 6.13 for RHEL 8 | Fixed | RHSA-2023:2097 |
Not affected: 5 products
- RHUI 4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Satellite 6
- Red Hat Satellite 6.13 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-24580
- 2026-10-03 Alias added: GHSA-2hrw-hx67-34x6
References
Patch 2
Advisory 8
Other 21
- https://groups.google.com/forum/#%21forum/django-announce
- https://security.netapp.com/advisory/ntap-20230316-0006/
- https://github.com/django/django/commit/628b33a854a9c68ec8a0c51f382f304a0044ec92
- https://github.com/django/django/commit/83f1ea83e4553e211c1c5a0dfc197b66d4e50432
- https://github.com/django/django/commit/a665ed5179f5bbd3db95ce67286d0192eff041d8
- https://www.djangoproject.com/weblog/2023/feb/14/security-releases
- https://security.netapp.com/advisory/ntap-20230316-0006
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B
- https://groups.google.com/forum/#!forum/django-announce
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-13.yaml
- https://github.com/django/django
- https://docs.djangoproject.com/en/4.1/releases/security
Sources
- CVE-2023-24580 · CVE Program
- CVE-2023-24580 · NVD
- FIRST EPSS
- GHSA-2hrw-hx67-34x6 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-24580 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences