CVE-2023-41164

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uritoiri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

3591e1c1acbd7c13174275367c3fdf012cb0413b

Fixed

fd0ccd7fb3ec8aee9a88ab0576059c7393397c8d

Introduced

9fee86e44dd83dc968ec443adcde191b3eba1286

Fixed

618a0e797b54c62d9ee78c3c5bdc27f954685836

Introduced

879e5d587b84e6fc961829611999431778eb9f6a

Fixed

b8b2f7451201f3ff60891b6ce55f177400700d7a

Database specific

{
    "versions": [
        {
            "introduced": "3.2"
        },
        {
            "fixed": "3.2.21"
        },
        {
            "introduced": "4.1"
        },
        {
            "fixed": "4.1.11"
        },
        {
            "introduced": "4.2"
        },
        {
            "fixed": "4.2.5"
        }
    ]
}

Affected versions

4.*

4.2

4.2.1

4.2.2

4.2.3

4.2.4

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "39"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41164.json"