CVE-2023-41164: Django Denial of Service Vulnerability in django.utils.encoding.uri_to_iri
Summary
CVE-2023-41164: Django Denial of service vulnerability in django.utils.encoding.uri_to_iri. Affects django across 3 version ranges.
>= 3.2, < 3.2.21
>= 4.1, < 4.1.11
>= 4.2, < 4.2.5
Fixed in 3.2.21, 4.1.11 or 4.2.5, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2023-41164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and versatility. It provides developers with a set of tools and libraries to build robust web applications. The vulnerability in question affects the 'django.utils.encoding.uri_to_iri' function, which is responsible for converting URIs to Internationalized Resource Identifiers (IRIs).
Vulnerability Detail
The vulnerability present in Django versions 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5 allows for a potential Denial of Service (DoS) attack. Attackers can exploit this vulnerability by providing inputs with an excessively large number of Unicode characters. This can overwhelm the function, leading to resource exhaustion and potentially impacting the availability of the affected Django application.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.2, < 3.2.213.2.21pip install --upgrade "django==3.2.21" -
>= 4.1, < 4.1.114.1.11pip install --upgrade "django==4.1.11" -
>= 4.2, < 4.2.54.2.5pip install --upgrade "django==4.2.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and limit the size of inputs passed to the 'django.utils.encoding.uri_to_iri' function. By enforcing reasonable limits on the input size, the risk of a DoS attack can be mitigated. Here's an example of how to limit the input size using Python code:
from django.utils.encoding import uri_to_iri
MAX_INPUT_SIZE = 1000
def safe_uri_to_iri(uri):
if len(uri) > MAX_INPUT_SIZE:
raise ValueError('Input size exceeds maximum allowed')
return uri_to_iri(uri)
By implementing this workaround, the application can reject excessively large inputs and prevent the DoS attack.
Conclusion
In conclusion, the Django framework is susceptible to a Denial of Service (DoS) vulnerability in the 'django.utils.encoding.uri_to_iri' function. Upgrading to the patched versions or implementing the provided workaround can mitigate the risk of exploitation. For further assistance or support in addressing this vulnerability, please reach out to DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability can lead to a Denial of Service (DoS) condition in Django applications. Attackers can exploit the vulnerability by providing inputs with a large number of Unicode characters, potentially causing resource exhaustion and impacting the availability of the application.
Django versions 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade Django to version 3.2.21, 4.1.11, or 4.2.5, depending on the version currently in use.
Yes, a temporary workaround is to implement input validation and limit the size of inputs passed to the 'django.utils.encoding.uri_to_iri' function. By enforcing reasonable limits on the input size, the risk of a DoS attack can be mitigated.
You can find more information about this vulnerability, including the technical details and the affected functions, in the advisory provided by the GitHub Advisory Database: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
