Vulnerability record · CVE-2023-24580 · published 15 February 2023
CVE-2023-24580: Django multipart parser resource exhaustion denial of service
Djangoproject · Django
Django's Multipart Request Parser mishandles certain inputs, such as an excessive number of parts, allowing uncontrolled resource consumption. Affected versions are Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. The flaw matters because a remote unauthenticated request can exhaust file descriptors or memory and degrade or take down the service.
Description
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote unauthenticated availability impact with a CVSS of 7.5 and very high EPSS probability, though no KEV listing or known exploitation is recorded.
What it is
Django's Multipart Request Parser mishandles certain inputs, such as an excessive number of parts, allowing uncontrolled resource consumption. Affected versions are Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. The flaw matters because a remote unauthenticated request can exhaust file descriptors or memory and degrade or take down the service.
Impact
An attacker can cause too many open files or memory exhaustion, resulting in a denial of service against the Django application. No data confidentiality or integrity impact is described; the effect is availability loss.
Attack surface
Reached over the network by sending crafted multipart form requests to an endpoint that parses multipart data. The CVSS vector shows no privileges and no user interaction required.
Exploitation
Not listed in CISA KEV and no ransomware use documented, but EPSS is high at roughly 0.63 probability (99th percentile), and references include vendor patch and advisory material rather than public exploit tags.
What to do
- Upgrade Django to 3.2.18, 4.0.10, 4.1.7 or later as applicable.
- Apply the distribution vendor updates for Django packages on Debian, Fedora and other affected platforms.
- Enforce request body size and multipart part count limits at the reverse proxy or web server.
- Raise file descriptor and memory limits only as a stopgap, and monitor for exhaustion under load.
Detection
- Alert on spikes in open file descriptors or memory usage in Django worker processes.
- Monitor for requests with unusually high multipart part counts or oversized multipart bodies.
- Watch for repeated 500 errors or worker restarts on endpoints that accept file uploads.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-24580 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-24580), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
