Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in Django. The undocumented django.utils.http.parse_header_parameters() function, used when parsing HTTP header values such as Accept and Content-Type (for example during content negotiation performed by HttpRequest.accepts()), had quadratic time complexity when a quoted parameter value contained many separator characters. A remote, unauthenticated attacker could send a request with a crafted header value to consume excessive CPU time on the handling worker. The existing per-call header length limit does not bound the combined size of repeated headers, so a request containing several affected headers could compound the cost. The upstream fix replaces the parsing logic with Python's email.message.Message, which also changes how some malformed or unusual header values (e.g. RFC 2231 values with a missing encoding) are decoded.