# CVE-2023-24580: Django multipart request parser resource exhaustion

Source: https://junglewise.ai/threats/cve-2023-24580-django-multipart-request-parser-resource-exhaustion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-02-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-24580 · Severity: low · CVSS 3.1 · Published 2023-02-15

Django, a popular Python web framework used to build web applications, contains a vulnerability in its multipart form parser that processes file uploads. An attacker can submit specially crafted requests with an excessive number of file parts, causing the server to exhaust memory or run out of open file handles, resulting in denial of service and making the application unavailable to legitimate users.

Technologies: [Django (PyPI)](https://junglewise.ai/threats/technologies/django). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2023-24580 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-24580 being exploited in the wild.

**How severe is CVE-2023-24580?** Low severity, with a CVSS score of 3.1, published 15 February 2023.

**Which products and versions are affected?** Django (PyPI) ECOSYSTEM:introduced=3.2,fixed=3.2.18,introduced=4.0,fixed=4.0.10,introduced=4.1,fixed=4.1.7, ECOSYSTEM:introduced=3.2a1,fixed=3.2.18.

**Is there a fix for CVE-2023-24580?** Yes. Django (PyPI): upgrade to 3.2.18, 4.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-24580 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-24580?** Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Django (PyPI): upgrade to 3.2.18, 4.1.7 or later

  ```sh
  pip install "Django>=4.1.7"
  ```


## Technical details

The vulnerability is a resource exhaustion issue (CWE-400) in Django's multipart request parser used to handle file uploads. When processing multipart form data, the parser did not adequately limit the number of files that could be uploaded in a single request. An attacker can exploit this by submitting a crafted HTTP POST request with an excessive number of file parts, consuming server resources (memory and file descriptors) until exhaustion occurs. No authentication is required; the attack is network-accessible and requires no user interaction. The vulnerability affects Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Patches introduce a new setting `DATA_UPLOAD_MAX_NUMBER_FILES` (default 100) to enforce a hard limit on the number of files per multipart request.

## Affected products

- Django Django 3.2 before 3.2.18, 4.0 before 4.0.10, 4.1 before 4.1.7

## Identifiers

- CVE-2023-24580
- GHSA-2hrw-hx67-34x6
- PYSEC-2023-13

## Timeline

- 2023-02-15: disclosed: Advisory published
- 2023-02-14: patched: Patches released for affected versions

## References

- [https://github.com/django/django/commit/628b33a854a9c68ec8a0c51f382f304a0044ec92](https://github.com/django/django/commit/628b33a854a9c68ec8a0c51f382f304a0044ec92)

## Related threats

- [Django GeoDjango unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service)
- [Django GeoDjango spatial lookups file write and request forgery](https://junglewise.ai/threats/cve-2026-15307-django-geodjango-spatial-lookups-file-write-and-request-forgery)
- [PYSEC-2026-2449 - Django has a Race Condition vulnerability](https://junglewise.ai/threats/cve-2026-25674-django-has-a-race-condition-vulnerability)
- [PYSEC-2026-1296 - Django vulnerable to partial directory traversal via archives](https://junglewise.ai/threats/cve-2025-59682-django-vulnerable-to-partial-directory-traversal-via-archives)
- [Django DomainNameValidator header injection via newline characters](https://junglewise.ai/threats/cve-2026-53878-django-domainnamevalidator-header-injection-via-newline)