CVE-2022-41323

python-django: Potential denial-of-service vulnerability in internationalized URLs

Published Oct 16, 2022 CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Description
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-5254-1 python-django security update
EUVD EUVD EUVD-2022-0094 In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
Github GHSA Github GHSA GHSA-qrw5-5h28-6cmg Django denial-of-service vulnerability in internationalized URLs
Ubuntu USN Ubuntu USN USN-5653-1 Django vulnerability
History
Type Values Removed Values Added
Weaknesses CWE-1333
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
May 14, 2025, 2:39 PM
Reserved
Sep 23, 2022, 12:00 AM
Status
Modified
Published
Oct 16, 2022, 6:15 AM
Modified
Jun 17, 2026, 5:03 AM
Severity
Moderate
Public date
Oct 4, 2022, 12:00 AM