The flaw is in the Multipart Request Parser component of Django, affecting versions 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Because it does not adequately limit resource consumption, certain inputs such as an excessive number of parts in a multipart form can exhaust open files or memory, and an attacker can use this to cause denial of service without authentication, user interaction, or special configuration, over the network.
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
Disclosed on 15 Feb 2023. No public exploit code or confirmed exploitation is recorded.
A fix was bypassed or incomplete 2 times over 6 years. The latest fix listed for Django is 4.2.5.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: Django.
Upgrade to 4.1.7 or later
pip install "Django>=4.1.7"The first fix for CVE-2023-24580.
| If you run | Upgrade to |
|---|---|
| 4.1 up to 4.1.7 | 4.1.7 |
| 4.1a1 up to 4.1.7 | 4.1.7 |
| 4.0 up to 4.0.10 | 4.0.10 |
| 4.0a1 up to 4.0.10 | 4.0.10 |
| 3.2 up to 3.2.18 | 3.2.18 |
| 3.2a1 up to 3.2.18 | 3.2.18 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.