CVE-2022-23833: Django MultiPartParser Infinite Loop Vulnerability
Summary
CVE-2022-23833: An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Affects django across 3 version ranges.
>= 2.2, < 2.2.27
>= 3.2, < 3.2.12
>= 4.0, < 4.0.2
Fixed in 2.2.27, 3.2.12 or 4.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2022-23833 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides various features and tools to handle common web development tasks. The MultiPartParser is a component in Django responsible for parsing multipart form data, including file uploads. This vulnerability affects Django versions 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2.
Vulnerability Detail
The MultiPartParser in Django is susceptible to an infinite loop when parsing files in certain multipart forms. This can be triggered by passing specific inputs to the multipart forms. An attacker could exploit this vulnerability to cause a denial-of-service (DoS) condition by submitting malicious multipart form data, resulting in excessive resource consumption and potentially crashing the server.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.272.2.27pip install --upgrade "django==2.2.27" -
>= 3.2, < 3.2.123.2.12pip install --upgrade "django==3.2.12" -
>= 4.0, < 4.0.24.0.2pip install --upgrade "django==4.0.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patches or upgrade to the fixed versions of Django.
Conclusion
The Django MultiPartParser Infinite Loop vulnerability can be exploited to cause a denial-of-service condition. It is recommended to upgrade Django to the latest patched version or apply the official patches to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies web application development.
The MultiPartParser is a component in Django responsible for parsing multipart form data, including file uploads.
This vulnerability can lead to an infinite loop when parsing files in certain multipart forms, potentially causing a denial-of-service condition.
To fix this vulnerability, upgrade Django to the latest patched version (2.2.27, 3.2.12, or 4.0.2).
No, there is no known workaround. It is crucial to apply the official patches or upgrade to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for django.
