PT-2026-106733

CVE-2026-84429

Published

2026-10-06

Updated

2026-10-28

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.2 Django versions prior to 6.0.9 Django versions prior to 5.2.18

Description A denial-of-service issue exists in the django.utils.http.parse header parameters() function. The problem arises from quadratic time complexity when parsing values containing numerous separators within a quoted parameter. An unauthenticated attacker can trigger this behavior by sending specially crafted headers, such as Accept or Content-Type, which are processed during content negotiation by HttpRequest.accepts(). The existing per-call length limit fails to restrict the combined size of repeated headers.

Recommendations Update to version 6.1.2 or later. Update to version 6.0.9 or later. Update to version 5.2.18 or later.

Exploitability

Exploit

Fix

Impacts

Researchers