CVE-2026-84429: Potential denial-of-service vulnerability in HTTP header parsing
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters() was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as Accept or Content-Type, for instance via the content negotiation performed by HttpRequest.accepts(). The per-call length limit does not bound the combined size of repeated headers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jisung Chae for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
Which Django versions are known to be affected and which versions contain the fix?
The issue affects Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. Updating to 6.1.2, 6.0.9, or 5.2.18, respectively, addresses the known affected releases.
Can an unauthenticated remote attacker trigger the denial of service?
Yes. An unauthenticated request can reach the vulnerable parsing through headers such as Accept or Content-Type, including content negotiation performed by HttpRequest.accepts().
What input pattern causes the excessive processing?
The issue is triggered when parsing a header value containing many separators inside a quoted parameter, causing quadratic-time behavior in parse_header_parameters(). Repeated headers can increase the combined input size because the per-call length limit does not bound their total size.
Are unsupported Django versions known to be safe?
No. Unsupported series, including examples such as 5.1.x, 5.0.x, and 4.2.x, were not evaluated and may also be affected.