CVE-2022-23833: Debian Linux

High severity, CVSS 7.5. EPSS: 49.5% chance of exploitation in the next 30 days.

An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

Affected products

• Debian Debian Linux: version 11.0 only
• Djangoproject Django: from 2.2, before 2.2.27 (fixed in 2.2.27); from 3.2, before 3.2.12 (fixed in 3.2.12); from 4.0, before 4.0.2 (fixed in 4.0.2)
• Fedoraproject Fedora: version 34 only; version 35 only

Published 2022-02-03. Last modified 2026-06-17.