CVE-2026-84429

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.2 Django versions prior to 6.0.9 Django versions prior to 5.2.18

Description A denial-of-service issue exists in the django.utils.http.parse header parameters() function. The problem arises from quadratic time complexity when parsing values containing numerous separators within a quoted parameter. An unauthenticated attacker can trigger this behavior by sending specially crafted headers, such as Accept or Content-Type, which are processed during content negotiation by HttpRequest.accepts(). The existing per-call length limit fails to restrict the combined size of repeated headers.

Recommendations Update to version 6.1.2 or later. Update to version 6.0.9 or later. Update to version 5.2.18 or later.