← Back

CVE-2025-14550

nvd nist
Published: Feb 3, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.

Affected (3)

Djangoproject
1 product
Django
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Djangoproject
Django
From 4.2 to 4.2.28
Django
From 5.2 to 5.2.11
Django
From 6.0 to 6.0.2

Related CWEs

CWE-407
Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References (3)

Source: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
PatchVendor Advisory
Source: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
Release Notes
Source: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
PatchVendor Advisory

Timeline

No history available yet.