Bug 2547367

Summary:	CVE-2026-84429 python-django5: Denial of service via quadratic parsing complexity in parse_header_parameters() [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Vladimir Vasilev <vvasilev>
Component:	python-django5	Assignee:	Michel Lind <michel>
Status:	ON_QA ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	michel, python-packagers-sig
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["8efe1234-5b89-43d8-b351-92d9e1891c0d"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2544147

Description Vladimir Vasilev 2026-10-07 10:28:18 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in Django. The undocumented django.utils.http.parse_header_parameters() function, used when parsing HTTP header values such as Accept and Content-Type (for example during content negotiation performed by HttpRequest.accepts()), had quadratic time complexity when a quoted parameter value contained many separator characters. A remote, unauthenticated attacker could send a request with a crafted header value to consume excessive CPU time on the handling worker. The existing per-call header length limit does not bound the combined size of repeated headers, so a request containing several affected headers could compound the cost. The upstream fix replaces the parsing logic with Python's email.message.Message, which also changes how some malformed or unusual header values (e.g. RFC 2231 values with a missing encoding) are decoded.

Comment 1 Fedora Update System 2026-10-08 13:07:20 UTC

FEDORA-2026-8a0e918188 (python-django5-5.2.18-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-8a0e918188

Comment 2 Fedora Update System 2026-10-08 13:07:32 UTC

FEDORA-2026-36373ca634 (python-django5-5.2.18-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-36373ca634

Comment 3 Fedora Update System 2026-10-08 13:07:47 UTC

FEDORA-2026-a7b8ff851a (python-django5-5.2.18-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a7b8ff851a

Comment 4 Fedora Update System 2026-10-09 02:08:55 UTC

FEDORA-2026-36373ca634 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-36373ca634`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-36373ca634

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-10-09 02:30:49 UTC

FEDORA-2026-8a0e918188 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-8a0e918188`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-8a0e918188

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-10-09 02:55:45 UTC

FEDORA-2026-a7b8ff851a has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a7b8ff851a`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-a7b8ff851a

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.