Quadratic parsing in Django HTTP headers allows denial of service
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 10 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-407.
Summary
Django from 6.1 before 6.1.2, from 6.0 before 6.0.9, and from 5.2 before 5.2.18 has inefficient algorithmic complexity (CWE-407) in django.utils.http.parse_header_parameters(). Parsing a value with many separators inside a quoted parameter takes quadratic time, so the cost grows much faster than the input size. An unauthenticated remote attacker can reach this parsing through headers such as Accept or Content-Type, and the per-call length limit does not bound the combined size of repeated headers, which can cause denial of service. Earlier unsupported series such as 5.1.x, 5.0.x, and 4.2.x were not evaluated and may also be affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does not bound the combined size of repeated headers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jisung Chae for reporting this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| djangoproject | Django | 6.1 to before 6.1.2; 6.0 to before 6.0.9; 5.2 to before 5.2.18 | 6.1.2, 6.0.9, 5.2.18 | Patch available | CNA |
- Django Vendordjangoproject Affected 6.1 to before 6.1.2; 6.0 to before 6.0.9; 5.2 to before 5.2.18 Fixed in 6.1.2, 6.0.9, 5.2.18 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | — | — | djangoproject |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions — — ·djangoproject
Remediation
Upgrade to Django 6.1.2, 6.0.9, or 5.2.18 for the matching series. Red Hat lists these products as affected without a fix: Red Hat OpenStack Platform 13 (Queens), 16.2, 17.1, and Red Hat Update Infrastructure 4 for Cloud Providers with no fix planned, and Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat OpenStack Platform 18.0, Red Hat Satellite 6, Red Hat Update Infrastructure 5, and Self-service automation portal 2 with plan none available.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Django (djangoproject) Fixed in 6.1.2, 6.0.9, 5.2.18
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
djangoproject Django — Django security releases issued: 6.1.2, 6.0.9, and 5.2.18
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2026-68435 Memory exhaustion in Django get_supported_language_variant()Priority LOW 37
- TI-2026-68440 Server-side request forgery in Django spatial lookup bytes valuesPriority LOW 36
- TI-2026-68441 Authorization bypass in Django model formsets lets users delete rowsPriority LOW 23
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Update Infrastructure 4 for Cloud Providers | Affected | No fix planned: Out of support scope |
| Red Hat Update Infrastructure 5 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-06 Threatist record created from CVE-2026-84429
- 2026-10-06 Alias added: GHSA-76g2-x83x-73r7
- 2026-10-07 Affected versions changed · Red Hat
- 2026-10-07 CVSS score added · Red Hat
References
Patch 4
- https://github.com/django/django/commit/7ff7fcc0508864a4bc39693128ace38b1e95a890
- https://github.com/django/django/commit/de56deeabd4c48dfb5193f0001469d80102fb367
- https://github.com/django/django/commit/3d8f121695c21234aff3071de0d38b6bd38c3f52
- https://github.com/django/django/commit/6ecd66e09a383be004a78a3a738ea9727ff07b0e
More djangoproject vulnerabilities
- TI-2022-15177 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. CVSS 3.1CRITICAL 9.8
- TI-2020-05994 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection… CVSS 3.1CRITICAL 9.8
- TI-2023-10198 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0… CVSS 3.1HIGH 7.5
- TI-2019-14306 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. CVSS 3.1CRITICAL 9.8
- TI-2019-10595 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x… CVSS 3.0CRITICAL 9.8
- TI-2021-14006 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-84429 · CVE Program
- CVE-2026-84429 · NVD
- FIRST EPSS
- GHSA-76g2-x83x-73r7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-84429 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences