CVE-2026-84429

Django contains an inefficient-algorithmic-complexity flaw (CWE-407) in django.utils.http.parse_header_parameters(), which takes quadratic time to parse a value containing many separators inside a quoted parameter. An unauthenticated attacker can trigger this through ordinary request headers such as Accept or Content-Type, for example via the content negotiation performed by HttpRequest.accepts(), and Django's per-call length limit does not bound the combined size of repeated headers. Successful exploitation lets a remote attacker with no credentials exhaust CPU on the server, causing denial of service; there is no impact on confidentiality or integrity. Affected deployments are those running Django 6.1 before 6.1.2, 6.0 before 6.0.9, or 5.2 before 5.2.18, and earlier unsupported series (5.1.x, 5.0.x, 4.2.x) were not evaluated and may also be affected. No public proof of concept is known and the issue is not listed in CISA's KEV catalog.

What to do: Upgrade promptly to Django 6.1.2, 6.0.9, or 5.2.18 depending on your series; if you are on an unsupported branch (5.1.x, 5.0.x, 4.2.x), move to a supported release since those versions were not evaluated and may still be vulnerable. As interim hardening, enforce strict limits on header size and the number of repeated headers (e.g., via nginx large_client_header_buffers or equivalent reverse-proxy/WAF settings) and consider filtering Accept/Content-Type headers containing abnormally long quoted parameters. Check whether your application calls HttpRequest.accepts() or otherwise exercises header parsing on unauthenticated endpoints.