CVE-2013-0306

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-05-02 · updated 2026-06-16
Weakness: CWE-189

Description

The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.

Affected products

Canonical Ubuntu Linux: 10.04, 11.10, 12.04, 12.10
Django: 1.3, 1.3-alpha1, 1.3-beta1, 1.3.1, 1.3.2, 1.3.3 (+7)

References

http://rhn.redhat.com/errata/RHSA-2013-0670.html
http://ubuntu.com/usn/usn-1757-1
http://www.debian.org/security/2013/dsa-2634
https://www.djangoproject.com/weblog/2013/feb/19/security/
http://rhn.redhat.com/errata/RHSA-2013-0670.html
http://ubuntu.com/usn/usn-1757-1
http://www.debian.org/security/2013/dsa-2634
https://www.djangoproject.com/weblog/2013/feb/19/security/

Get alerted when CVE-2013-0306 or the next vulnerability affects your stack