CVE-2026-84429
published 2026-10-06CVE-2026-84429: An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.38%
30.9th percentile
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does not bound the combined size of repeated headers.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Jisung Chae for reporting this issue.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | controller-rhel8 | — | — |
| ansible-automation-platform-24 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-24 | hub-rhel8 | — | — |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ansible-dev-tools-rhel8 | — | — |
| ansible-automation-platform-25 | controller-rhel8 | — | — |
| ansible-automation-platform-25 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-25 | gateway-rhel8 | — | — |
| ansible-automation-platform-25 | hub-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | aap-cloud-billing-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | metrics-service-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
django: Denial of service via quadratic parsing complexity in parse_header_parameters()
vendor_redhat·2026-10-06·CVSS 5.3
CVE-2026-84429 [MEDIUM] CWE-400 django: Denial of service via quadratic parsing complexity in parse_header_parameters()
django: Denial of service via quadratic parsing complexity in parse_header_parameters()
A flaw was found in Django. Inefficient processing occurs when the HTTP header parsing function handles quoted parameter values containing numerous separator characters. A remote, unauthenticated attacker could exploit this flaw by sending requests with crafted header parameters, causing excessive CPU consumption and leading to a Denial of Service (DoS).
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: ansible-automation-platform-24/controller-rhel8 (Red Hat Ansible Automation Platform 2) - Out of
VulDB
Django Software Foundation up to 5.2.17/6.0.8/6.1.1 Header Parsing django/utils/http.py django.utils.http.parse_header_parameters resource consumption (Nessus ID 364197)
vuldb·2026-10-09·CVSS 5.3
CVE-2026-84429 [MEDIUM] Django Software Foundation up to 5.2.17/6.0.8/6.1.1 Header Parsing django/utils/http.py django.utils.http.parse_header_parameters resource consumption (Nessus ID 364197)
A vulnerability, which was classified as problematic, was found in Django Software Foundation Django up to 5.2.17/6.0.8/6.1.1. Impacted is the function django.utils.http.parse_header_parameters of the file django/utils/http.py of the component Header Parsing. The manipulation results in resource consumption.
This vulnerability is identified as CVE-2026-84429. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
ghsa_unreviewed·2026-10-06
CVE-2026-84429 [MEDIUM] CWE-407 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does not bound the combined size of repeated headers.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Jisung Chae for reporting this issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-84429 python-django4.2: Denial of service via quadratic parsing complexity in parse_header_parameters() [epel-all]
bugzilla·2026-10-07·CVSS 5.3
CVE-2026-84429 [MEDIUM] CVE-2026-84429 python-django4.2: Denial of service via quadratic parsing complexity in parse_header_parameters() [epel-all]
CVE-2026-84429 python-django4.2: Denial of service via quadratic parsing complexity in parse_header_parameters() [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Django. The undocumented django.utils.http.parse_header_parameters() function, used when parsing HTTP header values such as Accept and Content-Type (for example during content negotiation performed by HttpRequest.accepts()), had quadratic time complexity when a quoted parameter value contained many separator characters. A remote, unauthenticated attacker could send a request with a crafted header value to consume excessive CPU
Bugzilla
CVE-2026-84429 python-django5: Denial of service via quadratic parsing complexity in parse_header_parameters() [fedora-all]
bugzilla·2026-10-07·CVSS 5.3
CVE-2026-84429 [MEDIUM] CVE-2026-84429 python-django5: Denial of service via quadratic parsing complexity in parse_header_parameters() [fedora-all]
CVE-2026-84429 python-django5: Denial of service via quadratic parsing complexity in parse_header_parameters() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Django. The undocumented django.utils.http.parse_header_parameters() function, used when parsing HTTP header values such as Accept and Content-Type (for example during content negotiation performed by HttpRequest.accepts()), had quadratic time complexity when a quoted parameter value contained many separator characters. A remote, unauthenticated attacker could send a request with a crafted header value to consume excessive CPU
Bugzilla
CVE-2026-84429 python-django6: Denial of service via quadratic parsing complexity in parse_header_parameters() [fedora-all]
bugzilla·2026-10-07·CVSS 5.3
CVE-2026-84429 [MEDIUM] CVE-2026-84429 python-django6: Denial of service via quadratic parsing complexity in parse_header_parameters() [fedora-all]
CVE-2026-84429 python-django6: Denial of service via quadratic parsing complexity in parse_header_parameters() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Django. The undocumented django.utils.http.parse_header_parameters() function, used when parsing HTTP header values such as Accept and Content-Type (for example during content negotiation performed by HttpRequest.accepts()), had quadratic time complexity when a quoted parameter value contained many separator characters. A remote, unauthenticated attacker could send a request with a crafted header value to consume excessive CPU
Bugzilla
CVE-2026-84429 django: Denial of service via quadratic parsing complexity in parse_header_parameters()
bugzilla·2026-09-30·CVSS 5.3
CVE-2026-84429 [MEDIUM] CVE-2026-84429 django: Denial of service via quadratic parsing complexity in parse_header_parameters()
CVE-2026-84429 django: Denial of service via quadratic parsing complexity in parse_header_parameters()
A flaw was found in Django. The undocumented django.utils.http.parse_header_parameters() function, used when parsing HTTP header values such as Accept and Content-Type (for example during content negotiation performed by HttpRequest.accepts()), had quadratic time complexity when a quoted parameter value contained many separator characters. A remote, unauthenticated attacker could send a request with a crafted header value to consume excessive CPU time on the handling worker. The existing per-call header length limit does not bound the combined size of repeated headers, so a request containing several affected headers could compound the cost. The upstream fix replaces the parsing logic wi
https://docs.djangoproject.com/en/dev/releases/security/https://github.com/django/django/commit/3d8f121695c21234aff3071de0d38b6bd38c3f52https://github.com/django/django/commit/6ecd66e09a383be004a78a3a738ea9727ff07b0ehttps://github.com/django/django/commit/7ff7fcc0508864a4bc39693128ace38b1e95a890https://github.com/django/django/commit/de56deeabd4c48dfb5193f0001469d80102fb367https://groups.google.com/g/django-announcehttps://www.djangoproject.com/weblog/2026/oct/06/security-releases/
2026-10-06
Published