REDHAT-BUG-2436341: Medium severity Django Django vulnerability
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2436341?
The severity of REDHAT-BUG-2436341 is rated high due to its potential for denial-of-service attacks via crafted requests.
How do I fix REDHAT-BUG-2436341?
To fix REDHAT-BUG-2436341, upgrade to Django versions 6.0.2, 5.2.11, or 4.2.28 or later.
What versions of Django are affected by REDHAT-BUG-2436341?
Django versions prior to 6.0.2, 5.2.11, and 4.2.28 are affected by REDHAT-BUG-2436341.
Who can exploit REDHAT-BUG-2436341?
Any remote attacker can exploit REDHAT-BUG-2436341 by sending specially crafted requests with multiple duplicate headers.
What type of vulnerability is REDHAT-BUG-2436341?
REDHAT-BUG-2436341 is a denial-of-service vulnerability that can disrupt the availability of affected applications.