CVE-2026-84429

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does not bound the combined size of repeated headers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jisung Chae for reporting this issue.

• CWE-407

• https://docs.djangoproject.com/en/dev/releases/security/
• https://github.com/django/django/commit/3d8f121695c21234aff3071de0d38b6bd38c3f52
• https://github.com/django/django/commit/6ecd66e09a383be004a78a3a738ea9727ff07b0e
• https://github.com/django/django/commit/7ff7fcc0508864a4bc39693128ace38b1e95a890
• https://github.com/django/django/commit/de56deeabd4c48dfb5193f0001469d80102fb367
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/oct/06/security-releases/

Published

Oct 6, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84421IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a re…8.8
• CVE-2026-84422IBM Guardium Data Protection 12.2 is vulnerable to command i…7.2
• CVE-2026-84423A vulnerability has been found in Casdoor up to 4.0.0. This …7.3
• CVE-2026-84425A vulnerability was found in zhayujie CowAgent up to 2.1.3. …4.3
• CVE-2026-84427A vulnerability was determined in zhayujie CowAgent up to 2.…4.3
• CVE-2026-84428fastify versions before 5.12.2 implement the case-insensitiv…7.5
• CVE-2026-8443The WP Review Slider Pro plugin for WordPress is vulnerable …8.8
• CVE-2026-84430A security vulnerability has been detected in gouguoa up to …6.3
• CVE-2026-84431A vulnerability was detected in AirAsia MOVE App up to 12.47…4.4
• CVE-2026-84432Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF …5.3
• CVE-2026-84434The Gravity Forms plugin for WordPress is vulnerable to Arbi…9.8
• CVE-2026-84436IBM Guardium Data Protection 12.2 is vulnerable to command i…9.1