CVE-2023-24580 — Vulnetix

CVE-2023-24580 PUBLISHED

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

EPSS 19.67% · 95.6th percentile

Risk Scores

EPSS Score

19.67%

95.6th percentile

Affected Products

Vendor	Product	Versions
Bitnami	django	3.2.0, 4.0.0, 4.1.0
Bitnami	django	3.2.0, 4.0.0, 4.1.0

Timeline

CVE Published
Feb 15, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 20, 2023 PoC Published
Mar 18, 2025 PoC Published
Mar 20, 2025 EPSS Score
Mar 21, 2025 EPSS Score
Mar 26, 2025 EPSS Score
Mar 29, 2025 EPSS Score
Apr 15, 2025 EPSS Score
May 1, 2025 EPSS Score
Jun 1, 2025 EPSS Score

References

http://www.openwall.com/lists/oss-security/2023/02/14/1 url
https://docs.djangoproject.com/en/4.1/releases/security/ url
https://groups.google.com/forum/#%21forum/django-announce url
https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/ url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/ url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/ url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/ url
https://security.netapp.com/advisory/ntap-20230316-0006/ url
https://www.djangoproject.com/weblog/2023/feb/14/security-releases/ url
https://nvd.nist.gov/vuln/detail/CVE-2023-24580 url

Open in Interactive Console →