{"id":"CVE-2023-41164","published":"2023-11-03T00:00:00Z","modified":"2025-11-04T17:12:37Z","title":"In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01519,"percentile":0.74476,"provenance":"source"},"cwes":[],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":[]},{"url":"https://docs.djangoproject.com/en/4.2/releases/security/","tags":[]},{"url":"https://www.djangoproject.com/weblog/2023/sep/04/security-releases/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/","tags":["vendor-advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20231214-0002/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/","tags":[]}],"priority":{"score":14.9,"factors":[{"name":"EPSS percentile","points":14.9}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=3.2, <3.2.21",">=4.1, <4.1.11",">=4.2, <4.2.5"],"patched":["3.2.21","4.1.11","4.2.5"],"from":["GHSA-7h4p-27mh-hmrw","PYSEC-2023-225"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0069","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2023-24580","published":"2023-02-15","fixed":"4.1.7","kev":false},{"cve":"CVE-2023-31047","published":"2023-05-07","fixed":"4.2.1","kev":false},{"cve":"CVE-2023-36053","published":"2023-07-03","fixed":"4.2.3","kev":false,"link":{"from":"CVE-2023-36053","to":"CVE-2023-41164","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.20","toFixed":"3.2.21","daysApart":123},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.1.10","toFixed":"4.1.11","daysApart":123}]}},{"cve":"CVE-2023-41164","published":"2023-11-03","fixed":"4.2.5","kev":false},{"cve":"CVE-2023-43665","published":"2023-11-03","fixed":"4.2.6","kev":false,"link":{"from":"CVE-2023-41164","to":"CVE-2023-43665","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.21","toFixed":"3.2.22","daysApart":0},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.1.11","toFixed":"4.1.12","daysApart":0},{"kind":"similar","provenance":"machine","score":0.24,"basis":"same package + description similarity"}]}},{"cve":"CVE-2023-46695","published":"2023-11-02","fixed":"4.2.7","kev":false},{"cve":"CVE-2024-24680","published":"2024-02-06","fixed":"5.0.2","kev":false}],"package":"PyPI:Django"}}