VulnerabilityModified
CVE-2023-46695
As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
HIGH 7.5EPSS 49.8%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 49.8%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 49.77% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- djangoproject/django
- Source
- cve@mitre.org
References
- https://docs.djangoproject.com/en/4.2/releases/security/Patch
- https://groups.google.com/forum/#%21forum/django-announcePermissions Required
- https://security.netapp.com/advisory/ntap-20231214-0001/
- https://www.djangoproject.com/weblog/2023/nov/01/security-releases/Patch, Vendor Advisory
- https://docs.djangoproject.com/en/4.2/releases/security/Patch
- https://groups.google.com/forum/#%21forum/django-announcePermissions Required
- https://security.netapp.com/advisory/ntap-20231214-0001/
- https://www.djangoproject.com/weblog/2023/nov/01/security-releases/Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.