# CVE-2026-84429: Django parse_header_parameters denial of service

Source: https://junglewise.ai/threats/cve-2026-84429-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-84429 · Severity: medium · CVSS 5.3 · Published 2026-10-06

Django is a popular Python web framework used to build web applications. The `parse_header_parameters()` function, which processes HTTP headers like Accept and Content-Type, contains a flaw that allows unauthenticated attackers to cause denial of service by sending specially crafted requests with many separators in quoted parameters. This can make Django applications unresponsive to legitimate users.

Technologies: [Django Software Foundation Django](https://junglewise.ai/threats/technologies/django-software-foundation-django). Vendors: [Django Software Foundation](https://junglewise.ai/threats/vendors/django-software-foundation).

## Quick answers

**Is CVE-2026-84429 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84429 being exploited in the wild.

**How severe is CVE-2026-84429?** Medium severity, with a CVSS score of 5.3, published 6 October 2026.

**Which products and versions are affected?** Django Software Foundation Django 6.1 before 6.1.2, 6.0 before 6.0.9, 5.2 before 5.2.18.

**Is there a fix for CVE-2026-84429?** Yes: fixed in Django 6.1.2, 6.0.9, 5.2.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84429 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84429?** Check whether you run Django Software Foundation Django at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Django 6.1.2, 6.0.9, 5.2.18

## Technical details

The vulnerability exists in Django's `django.utils.http.parse_header_parameters()` function due to quadratic time complexity when parsing values with many separators inside quoted parameters. An unauthenticated attacker can reach this code via HTTP headers (Accept, Content-Type) processed during content negotiation through `HttpRequest.accepts()`. The per-call length limit does not bound the combined size of repeated headers, allowing resource exhaustion.

## Affected products

- Django Software Foundation Django 6.1 before 6.1.2, 6.0 before 6.0.9, 5.2 before 5.2.18

## Timeline

- 2026-10-06: disclosed

## References

- [https://pypi.org/project/Django/](https://pypi.org/project/Django/)
- [https://docs.djangoproject.com/en/dev/releases/security/](https://docs.djangoproject.com/en/dev/releases/security/)

## Related threats

- [Django GIS spatial reference string injection](https://junglewise.ai/threats/cve-2026-114582-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django SSRF in GeoJSON coordinate reference systems](https://junglewise.ai/threats/cve-2026-111362-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django log injection in BaseGeometryWidget.deserialize()](https://junglewise.ai/threats/cve-2026-111211-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django multipart parser excessive memory consumption via base64 Content-Transfer-Encoding](https://junglewise.ai/threats/cve-2026-108147-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-4-before)
- [Django authorization bypass in BaseModelFormSet deletion](https://junglewise.ai/threats/cve-2026-87975-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0)