An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. (CVE-2026-84429)

CVE-2026-84429 describes a denial-of-service vulnerability in Django's parse_header_parameters() function due to quadratic time complexity when processing header values containing many separators within quoted parameters. This function is used in HTTP content negotiation, such as through HttpRequest.accepts(), and an attacker can exploit this by sending crafted headers to cause excessive processing time. The vulnerability affects Django versions before 6.1.2, 6.0.9, and 5.2.18. Earlier unsupported versions may also be affected but were not evaluated. The vulnerability does not impact confidentiality or integrity but can cause availability degradation.

The vulnerability allows an unauthenticated attacker to cause a denial-of-service condition by sending specially crafted HTTP headers that trigger excessive CPU usage due to inefficient parsing logic. There is no impact on confidentiality or integrity. The attack surface includes headers such as Accept and Content-Type, which are commonly used in HTTP requests.

A fix is available in Django versions 6.1.2, 6.0.9, and 5.2.18. Users should upgrade to these or later versions to remediate the vulnerability. There is no vendor advisory content provided here, but the presence of fixed versions indicates an official fix is available. No additional mitigations are specified.