CVE-2022-41323
HIGHDjango 3.2-4.1 - Denial of Service via Locale Parameter Regular Expression
Title source: llmDescription
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
References (10)
Core 10
Core References
Release Notes, Vendor Advisory
https://docs.djangoproject.com/en/4.0/releases/security/
Patch, Third Party Advisory
https://github.com/django/django/commit/5b6b257fa7ec37ff27965358800c67e2dd11c924
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221124-0001/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
Scores
CVSS v3
7.5
EPSS
0.0272
EPSS Percentile
84.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-1333
Status
published
Products (2)
djangoproject/django
3.2 - 3.2.16
pypi/Django
3.2 - 3.2.16PyPI
Published
Oct 16, 2022
Tracked Since
Feb 18, 2026