Vulnerability record · CVE-2023-23969 · published 1 February 2023
CVE-2023-23969: Django Accept-Language header caching allows memory exhaustion DoS
Djangoproject · Django
Django caches parsed Accept-Language header values to avoid repeated parsing, but does not bound the size of the raw header it stores. An attacker can send very large Accept-Language headers to drive excessive memory usage and cause denial of service. Affected versions are Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6.
Description
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityCVSS 7.5 with network reachability and no authentication, plus a high EPSS percentile, makes this a realistic availability threat despite no KEV listing.
What it is
Django caches parsed Accept-Language header values to avoid repeated parsing, but does not bound the size of the raw header it stores. An attacker can send very large Accept-Language headers to drive excessive memory usage and cause denial of service. Affected versions are Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6.
Impact
An unauthenticated attacker can consume server memory and degrade or exhaust application availability. There is no data confidentiality or integrity impact; the effect is denial of service.
Attack surface
Reached over the network through HTTP requests to any Django endpoint that processes Accept-Language headers, which is typical for locale and internationalization handling. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at roughly 0.47 probability (98.8th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Upgrade Django to 3.2.17, 4.0.9, 4.1.6 or later; the vendor security release contains the fix.
- Apply the corresponding Debian, Fedora or NetApp vendor updates for packaged Django deployments.
- Enforce a maximum request header size at the reverse proxy or web server to cap oversized Accept-Language values.
- Monitor memory usage on Django hosts and alert on abnormal growth correlated with request volume.
Detection
- Alert on HTTP requests with unusually large Accept-Language header values in web server or WAF logs.
- Track per-process memory growth on Django application servers and correlate spikes with request patterns.
- Review proxy and application logs for repeated requests from single sources sending oversized headers.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-23969 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-23969), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
