Description
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High
Affected Packages2 packages
🔴Vulnerability Details
4GHSADjango denial-of-service vulnerability in internationalized URLs↗2022-10-16 OSVCVE-2022-41323: In Django 3↗2022-10-16 OSVDjango denial-of-service vulnerability in internationalized URLs↗2022-10-16 CVEListCVE-2022-41323: In Django 3↗2022-10-16 📋Vendor Advisories
3UbuntuDjango vulnerability↗2022-10-04 Red Hatpython-django: Potential denial-of-service vulnerability in internationalized URLs↗2022-10-04 DebianCVE-2022-41323: python-django - In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internation...↗2022