Executive brief
Django, a popular Python web framework used to build web applications, contains a vulnerability in its multipart form parser that processes file uploads. An attacker can submit specially crafted requests with an excessive number of file parts, causing the server to exhaust memory or run out of open file handles, resulting in denial of service and making the application unavailable to legitimate users.
Technical details
The vulnerability is a resource exhaustion issue (CWE-400) in Django's multipart request parser used to handle file uploads. When processing multipart form data, the parser did not adequately limit the number of files that could be uploaded in a single request. An attacker can exploit this by submitting a crafted HTTP POST request with an excessive number of file parts, consuming server resources (memory and file descriptors) until exhaustion occurs. No authentication is required; the attack is network-accessible and requires no user interaction. The vulnerability affects Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Patches introduce a new setting `DATA_UPLOAD_MAX_NUMBER_FILES` (default 100) to enforce a hard limit on the number of files per multipart request.
Affected products
- Django Django 3.2 before 3.2.18, 4.0 before 4.0.10, 4.1 before 4.1.7
Timeline
- 2023-02-15: disclosed: Advisory published
- 2023-02-14: patched: Patches released for affected versions