Django DoS via HTTP Header Parsing in parse_header_parameters (CVE-2026-84429)

Vulnerability Overview CVE ID: CVE-2026-84429 Vulnerability Type: Denial of Service (DoS) Description: The function has a potential Denial of Service (DoS) vulnerability when handling quoted parameters containing multiple delimiters. Unauthenticated requests can trigger this vulnerability through content negotiation mechanisms in headers such as or . Since there is no limit on the combined size of repeated headers for each call to , this can lead to excessive CPU consumption. Affected Scope Affected Module: Affected Versions: Django 5.2.18 and earlier Severity: Low (according to Django's security policy) Remediation Fixed Version: Django 5.2.18 Fix Details: - Simplified the function by replacing the original module with Python's API. - Used the function to handle values encoded according to RFC 2231. - Used and to handle URL encoding. - Used and to handle URL encoding. - Used the module to handle dates and times. - Used the module to handle Unicode data. - Used the module to handle Base64 encoding. - Used the module to handle encoding and decoding. - Used the module to handle regular expressions. - Used to handle date formatting. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to handle address parsing. - Used to

Goal Reached Thanks to every supporter — we hit 100%!

Django DoS via HTTP Header Parsing in parse_header_parameters (CVE-2026-84429)

More from this source