CVE-2022-41323

Django's internationalized URLs feature had a flaw where the locale parameter was processed as a regular expression, allowing attackers to cause denial of service by submitting specially crafted locale values that would consume excessive server resources.

A regular expression denial of service (ReDoS) vulnerability exists in Django's URL internationalization handling where user-supplied locale parameters are compiled as regex patterns without proper validation. An unauthenticated attacker can submit malicious locale strings to trigger catastrophic backtracking, exhausting CPU resources and causing application unavailability.