CVE-2022-41323highCWE-1333

CVE-2022-41323

Published · Updated

Follow this CVE+ Monitor python-django+ Monitor django

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 3.8%
In short

Django's internationalized URLs feature had a flaw where the locale parameter was processed as a regular expression, allowing attackers to cause denial of service by submitting specially crafted locale values that would consume excessive server resources.

Technical detail

A regular expression denial of service (ReDoS) vulnerability exists in Django's URL internationalization handling where user-supplied locale parameters are compiled as regex patterns without proper validation. An unauthenticated attacker can submit malicious locale strings to trigger catastrophic backtracking, exhausting CPU resources and causing application unavailability.

Summary generated and translated by AI from the official description.
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a