VDB
BIT-django-2022-23833
BIT-django-2022-23833
PUBLISHED
CVSS 7.5 HIGH
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | django | 2.2.0, 3.2.0, 4.0.0 |
Timeline
- Mar 6, 2024 CVE Published
- Apr 3, 2025 CVE Updated
- May 11, 2026 Distribution Patch
References
- https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a url
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/ url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ url
- https://security.netapp.com/advisory/ntap-20220221-0003/ url
- https://nvd.nist.gov/vuln/detail/CVE-2022-23833 url
- https://groups.google.com/forum/#%21forum/django-announce url
- https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9 url
- https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468 url
- https://www.debian.org/security/2022/dsa-5254 url
- https://docs.djangoproject.com/en/4.0/releases/security/ url