Denial-of-Service Vulnerability in Django Multipart Request Parser

CVE-2023-24580

What is CVE-2023-24580?

A vulnerability exists in the Multipart Request Parser of the Django Framework that allows an attacker to pass specially crafted multipart form inputs containing an excessive number of parts. This can lead to resource depletion issues, such as exhausting the number of open files or memory, ultimately providing a vector for denial-of-service attacks. The affected versions include Django 3.2 prior to 3.2.18, 4.0 prior to 4.0.10, and 4.1 prior to 4.1.7. Ensuring updates to these versions is critical to mitigate this risk.

References