← Back to browse · API

CVE-2023-23969

Severity
HIGH
CVSS
7.5
EPSS
0.47381
Risk score
46.58
CISA KEV
No
PoC
Yes
Published
2023-02-01
Modified
2025-03-27
First seen
2026-08-07
Aliases
EUVD-2023-0066, GHSA-Q2JF-H9JM-M7P4, PYSEC-2023-12
Products
linux, n/a:n/a n/a, suse
Sources
euvd EUVD-2023-0066
packetstorm 2349a21bfe10b831f10dc24e|CVE-2023-23969

Description

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.

References