Intel/CVE-2023-23969
django
CVE-2023-23969
django is vulnerable to Denial of Service
Denial of Service Pre-CVE Published Feb 1, 2023
Found by Aikido Intel before public disclosure or CVE publication.
75
High Risk
This Affects:
djangoAre you affected? Scan for Free
TL;DR
Django is a web framework for Python. A denial of service attack is possible on this version of Django. It works by passing very large strings in the 'Accept-language' header, which is a standard header provided by the browser.
Who does this affect?
If you run and older version of Django to run a publicly facing web app, you will be affected.
Background info
django is vulnerable to Denial of Service in versions < 3.2.17, < 4.0.9 and < 4.1.6.
How to fix this
Do a version upgrade of Django. Some Web application firewalls might also protect against these kinds of irregular headers provided by a client.
Links
docs.djangoproject.com/en/4.1/releases/security/https://docs.djangoproject.com/en/4.1/releases/security/
groups.google.com/forum/#%21forum/django-announcehttps://groups.google.com/forum/#%21forum/django-announce
lists.debian.org/debian-lts-announce/2023/02/msg00000.htmlhttps://lists.debian.org/debian-lts-announce/2023/02/msg00000.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
security.netapp.com/advisory/ntap-20230302-0007/https://security.netapp.com/advisory/ntap-20230302-0007/
djangoproject.com/weblog/2023/feb/01/security-releases/https://www.djangoproject.com/weblog/2023/feb/01/security-releases/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
Resources
Industries
Use Cases
Compare
© 2026 Aikido Security BV | BE0792914919
Keizer Karelstraat 15, 9000, Ghent, Belgium
95 Third St, 2nd Fl, San Francisco, CA 94103, US
Unit 6.15 Runway East 18 18 Crucifix Ln, London SE1 3JW UK
Ghent, Belgium | San Francisco, US
SOC 2Compliant
ISO 27001Compliant