{"id":"CVE-2022-41323","published":"2022-10-16T00:00:00Z","modified":"2025-05-14T14:39:38Z","title":"In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.03751,"percentile":0.8985,"provenance":"source"},"cwes":[{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity"}],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":[]},{"url":"https://docs.djangoproject.com/en/4.0/releases/security/","tags":[]},{"url":"https://www.djangoproject.com/weblog/2022/oct/04/security-releases/","tags":[]},{"url":"https://github.com/django/django/commit/5b6b257fa7ec37ff27965358800c67e2dd11c924","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20221124-0001/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/","tags":["vendor-advisory"]}],"priority":{"score":23.2,"factors":[{"name":"EPSS percentile","points":17.97},{"name":"CVSS severity","points":5.25}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=3.2, <3.2.16",">=4.0, <4.0.8",">=4.1, <4.1.2"],"patched":["3.2.16","4.0.8","4.1.2"],"from":["GHSA-qrw5-5h28-6cmg","PYSEC-2022-304"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0094","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2018-14574","parents":[{"from":"CVE-2021-44420","to":"CVE-2022-41323","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/urls/resolvers.py"],"commits":["https://github.com/django/django/commit/d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6","https://github.com/django/django/commit/5b6b257fa7ec37ff27965358800c67e2dd11c924","https://github.com/django/django/commit/23f0093125ac2e553da6c1b2f9988eb6a3dd2ea1"],"basis":"shared function","functions":["__init__"]}]}],"packageHistory":[{"cve":"CVE-2022-28347","published":"2022-04-12","fixed":"4.0.4","kev":false},{"cve":"CVE-2022-34265","published":"2022-07-04","fixed":"4.0.6","kev":false},{"cve":"CVE-2022-36359","published":"2022-08-03","fixed":"4.0.7","kev":false,"link":{"from":"CVE-2022-36359","to":"CVE-2022-41323","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.15","toFixed":"3.2.16","daysApart":74},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.0.7","toFixed":"4.0.8","daysApart":74}]}},{"cve":"CVE-2022-41323","published":"2022-10-16","fixed":"4.1.2","kev":false},{"cve":"CVE-2023-23969","published":"2023-02-01","fixed":"4.1.6","kev":false,"link":{"from":"CVE-2022-41323","to":"CVE-2023-23969","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.16","toFixed":"3.2.17","daysApart":108},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.0.8","toFixed":"4.0.9","daysApart":108}]}},{"cve":"CVE-2023-24580","published":"2023-02-15","fixed":"4.1.7","kev":false},{"cve":"CVE-2023-31047","published":"2023-05-07","fixed":"4.2.1","kev":false}],"package":"PyPI:Django"}}