CVE-2023-24580: Resource exhaustion in Django

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 62.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-15 · updated 2026-06-17
Weakness: CWE-400

Description

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Affected products

Debian Linux: 10.0
Django: from 3.2 before 3.2.18; from 4.0 before 4.0.10; from 4.1 before 4.1.7 — fixed in 3.2.18, 4.0.10, 4.1.7
Pypi Django: from 3.2 before 3.2.18; from 4.0 before 4.0.10; from 4.1 before 4.1.7; 3.2, 3.2.1, 3.2.10, 3.2.11, 3.2.12, 3.2.13 (+29) — fixed in 3.2.18, 4.0.10, 4.1.7

How to fix

Upgrade to a fixed version: Django 3.2.18, 4.0.10, 4.1.7; Pypi Django 3.2.18, 4.0.10, 4.1.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-24580 or the next vulnerability affects your stack