CVE-2022-23833: Django MultiPartParser infinite loop on crafted multipart input

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable denial of service with a high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is documented.

What it is

Django's MultiPartParser can enter an infinite loop when parsing certain crafted multipart form inputs, affecting Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Because the parser is reachable through normal file upload handling, an unauthenticated request can tie up a worker process and degrade or deny service.

Impact

An attacker can consume server worker or thread resources indefinitely, causing request timeouts and denial of service for legitimate users. There is no confidentiality or integrity impact; the CVSS vector shows availability only.

Attack surface

Reached over the network by submitting a crafted multipart/form-data request to any endpoint that parses uploads. The CVSS vector indicates no privileges and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is high at roughly 0.495 (98.8th percentile), suggesting meaningful likelihood of attempted exploitation. The record does not state that a public exploit exists.

What to do

• Upgrade Django to 2.2.27, 3.2.12, 4.0.2 or later, or apply the referenced upstream commits.
• Update distribution packages (Debian DSA-5254, Fedora advisory) or vendor builds such as NetApp products that bundle Django.
• Enforce request body size and upload time limits at the reverse proxy or application server to bound parser work.
• Run upload-handling workers with timeouts and process recycling so a stuck parse cannot exhaust the pool.

Detection

• Monitor for worker processes or requests stuck in multipart parsing with abnormally long durations.
• Alert on spikes in request timeouts, 5xx responses, or worker pool saturation correlated with multipart/form-data uploads.
• Log and review repeated large or malformed multipart uploads from single sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.