Potential denial-of-service vulnerability via repeated headers when using ASGI (djangoproject Django)
En bref
- Source
- NVD
- EPSS
- EPSS 1.11 % · centile 66 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- DSF
- Statut NVD
- Analyzed
Rechercher sur…
Description
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.
Faiblesses (CWE)
- CWE-407 — Complexité algorithmique inefficace
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- GHSA-33mw-q7rj-mjwj — Django has Inefficient Algorithmic Complexity
- PYSEC-2026-43 — An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
Références européennes
- ENISA EUVD · EUVD-2025-206739
- GCVE · GCVE-0-2025-14550
Avis du CERT-FR
- CERTFR-2026-AVI-1056 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*≥ 4.2 < 4.2.28cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*≥ 5.2 < 5.2.11cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*≥ 6.0 < 6.0.2
Produits affectés
| Produit | Versions |
|---|---|
| djangoproject · Django | affected 6.0 < 6.0.2 ; unaffected 6.0.2 ; affected 5.2 < 5.2.11 ; unaffected 5.2.11 ; affected 4.2 < 4.2.28 ; unaffected 4.2.28 |
| djangoproject · asgiref | affected 3 < 3.11.1 ; unaffected 3.11.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |