An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.

Summary

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Timeline

1. Feb 15, 2023, 12:00 AM UTCCVE published
2. Mar 18, 2025, 7:24 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Mar 18, 2025, 7:24 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• djangoPyPI

  From 3.2a1 · fixed in 3.2.18

• djangoPyPI

  From 4.1a1 · fixed in 4.1.7

• djangoPyPI

  From 4.0a1 · fixed in 4.0.10

• djangoPyPI

  From 3.2 · fixed in 3.2.18; From 4.0 · fixed in 4.0.10; From 4.1 · fixed in 4.1.7

References 11