Executive brief
Django, a popular web framework for building Python applications, contains a vulnerability that could allow an attacker to slow down or crash a website. By sending a specially crafted web request containing many duplicate headers, an attacker can overwhelm the server's processing capabilities. This could lead to a denial-of-service, making the application unavailable to legitimate users.
Technical details
An inefficient algorithmic complexity vulnerability (CWE-407) exists in Django's ASGIRequest component. The root cause is the way the framework processes incoming HTTP headers when using the Asynchronous Server Gateway Interface (ASGI). A remote, unauthenticated attacker can exploit this by sending a network request containing a large number of duplicate headers, leading to excessive CPU consumption. This can result in a denial-of-service (DoS) condition. The issue is fixed in Django versions 6.0.2, 5.2.11, and 4.2.28. Older unsupported versions like 5.0.x and 3.2.x may also be affected but were not officially evaluated.
Affected products
- Django Software Foundation Django >= 6.0a1, < 6.0.2; >= 5.2a1, < 5.2.11; >= 4.2a1, < 4.2.28
Timeline
- 2026-02-03: disclosed
- 2026-02-03: advisory
- 2026-02-03: patched
References
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases
- https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-43.yaml