Bug 892806 – <dev-python/django-{3.2.17,4.0.9,4.1.6}: Potential denial-of-service via Accept-Language headers

• Status: CONFIRMED
• Product: Gentoo Security

[Description Michał Górny 2023-02-01 11:40:46 UTC]

CVE-2023-23969: Potential denial-of-service via Accept-Language headers¶

The parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if large header values are sent.

In order to avoid this vulnerability, the Accept-Language header is now parsed up to a maximum length.

[Comment 1 Michał Górny 2023-02-01 19:36:27 UTC]

Cleanup done.

[Comment 2 John Helmert III 2023-02-20 19:41:38 UTC]

Thanks!