CVE-2022-23833

An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

• CWE-835

• https://docs.djangoproject.com/en/4.0/releases/security/Patch, Third Party Advisory
• https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a
• https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
• https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9
• https://groups.google.com/forum/#%21forum/django-announce
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
• https://security.netapp.com/advisory/ntap-20220221-0003/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5254Third Party Advisory
• https://www.djangoproject.com/weblog/2022/feb/01/security-releases/Patch, Third Party Advisory
• https://docs.djangoproject.com/en/4.0/releases/security/Patch, Third Party Advisory
• https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a
• https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
• https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9
• https://groups.google.com/forum/#%21forum/django-announce
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
• https://security.netapp.com/advisory/ntap-20220221-0003/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5254Third Party Advisory
• https://www.djangoproject.com/weblog/2022/feb/01/security-releases/Patch, Third Party Advisory

Published

Feb 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23827Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-23829A potential weakness in AMD SPI protection features may allo…8.2
• CVE-2022-2383The Feed Them Social WordPress plugin before 3.0.1 does not …6.1
• CVE-2022-23830SMM configuration may not be immutable, as intended, when SN…5.3
• CVE-2022-23831Insufficient validation of the IOCTL input buffer in AMD μPr…7.5
• CVE-2022-23832Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-23835The Visual Voice Mail (VVM) application through 2022-02-24 f…8.1
• CVE-2022-23837In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no li…7.5
• CVE-2022-2384The Digital Publications by Supsystic WordPress plugin befor…4.8
• CVE-2022-23848In Alluxio before 2.7.3, the logserver does not validate the…9.8
• CVE-2022-23849The biometric lock in Devolutions Password Hub for iOS befor…6.6
• CVE-2022-2385A security issue was discovered in aws-iam-authenticator whe…8.8