Bug 2544147 (CVE-2026-84429)

Summary: CVE-2026-84429 django: Denial of service via quadratic parsing complexity in parse_header_parameters()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Django. Inefficient processing occurs when the HTTP header parsing function handles quoted parameter values containing numerous separator characters. A remote, unauthenticated attacker could exploit this flaw by sending requests with crafted header parameters, causing excessive CPU consumption and leading to a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2547366, 2547367, 2547368    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-30 17:21:30 UTC 
A flaw was found in Django. The undocumented django.utils.http.parse_header_parameters() function, used when parsing HTTP header values such as Accept and Content-Type (for example during content negotiation performed by HttpRequest.accepts()), had quadratic time complexity when a quoted parameter value contained many separator characters. A remote, unauthenticated attacker could send a request with a crafted header value to consume excessive CPU time on the handling worker. The existing per-call header length limit does not bound the combined size of repeated headers, so a request containing several affected headers could compound the cost. The upstream fix replaces the parsing logic with Python's email.message.Message, which also changes how some malformed or unusual header values (e.g. RFC 2231 values with a missing encoding) are decoded.