{"id":"CVE-2023-24580","published":"2023-02-15T00:00:00Z","modified":"2025-03-18T19:24:32Z","title":"An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in the Multipart Request Parser component of Django, affecting versions 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Because it does not adequately limit resource consumption, certain inputs such as an excessive number of parts in a multipart form can exhaust open files or memory, and an attacker can use this to cause denial of service without authentication, user interaction, or special configuration, over the network.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:00Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.62575,"percentile":0.99187,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"ACTUALIZACION | Oracle Solaris Third Party Bulletin Risk Matrix","url":"https://otx.alienvault.com/pulse/644a8c6e8d061b0ace67300a","created":"2023-04-27"}],"provenance":"machine"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":[]},{"url":"https://docs.djangoproject.com/en/4.1/releases/security/","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2023/02/14/1","tags":[]},{"url":"https://www.djangoproject.com/weblog/2023/feb/14/security-releases/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/","tags":["vendor-advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230316-0006/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=3.2a1, <3.2.18",">=4.1a1, <4.1.7",">=4.0a1, <4.0.10",">=3.2, <3.2.18",">=4.0, <4.0.10",">=4.1, <4.1.7"],"patched":["3.2.18","4.1.7","4.0.10"],"from":["GHSA-2hrw-hx67-34x6","PYSEC-2023-13"],"provenance":"source"}],"advisories":[{"id":"GHSA-2hrw-hx67-34x6","url":"https://github.com/advisories/GHSA-2hrw-hx67-34x6","severity":"HIGH","ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=3.2a1, <3.2.18"],"patched":["3.2.18"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2hrw-hx67-34x6","url":"https://github.com/advisories/GHSA-2hrw-hx67-34x6","severity":"HIGH","ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=4.1a1, <4.1.7"],"patched":["4.1.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2hrw-hx67-34x6","url":"https://github.com/advisories/GHSA-2hrw-hx67-34x6","severity":"HIGH","ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=4.0a1, <4.0.10"],"patched":["4.0.10"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-0067","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0067","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-02-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-24580","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9919"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-django-cve-2018-7537","parents":[{"from":"CVE-2021-31542","to":"CVE-2023-24580","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/http/multipartparser.py"],"commits":["https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d","https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48","https://github.com/django/django/commit/628b33a854a9c68ec8a0c51f382f304a0044ec92","https://github.com/django/django/commit/83f1ea83e4553e211c1c5a0dfc197b66d4e50432"],"basis":"rarely changed file"}]},{"from":"CVE-2022-23833","to":"CVE-2023-24580","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/http/multipartparser.py"],"commits":["https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a","https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468","https://github.com/django/django/commit/628b33a854a9c68ec8a0c51f382f304a0044ec92","https://github.com/django/django/commit/83f1ea83e4553e211c1c5a0dfc197b66d4e50432"],"basis":"shared function","functions":["parse"]},{"kind":"similar","provenance":"machine","score":0.44,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2022-36359","published":"2022-08-03","fixed":"4.0.7","kev":false},{"cve":"CVE-2022-41323","published":"2022-10-16","fixed":"4.1.2","kev":false},{"cve":"CVE-2023-23969","published":"2023-02-01","fixed":"4.1.6","kev":false,"link":{"from":"CVE-2023-23969","to":"CVE-2023-24580","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.17","toFixed":"3.2.18","daysApart":14},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.1.6","toFixed":"4.1.7","daysApart":14}]}},{"cve":"CVE-2023-24580","published":"2023-02-15","fixed":"4.1.7","kev":false},{"cve":"CVE-2023-31047","published":"2023-05-07","fixed":"4.2.1","kev":false,"link":{"from":"CVE-2023-24580","to":"CVE-2023-31047","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.18","toFixed":"3.2.19","daysApart":81},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.1.7","toFixed":"4.1.9","daysApart":81}]}},{"cve":"CVE-2023-36053","published":"2023-07-03","fixed":"4.2.3","kev":false},{"cve":"CVE-2023-41164","published":"2023-11-03","fixed":"4.2.5","kev":false}],"package":"PyPI:Django"}}