CVE-2026-84429: CWE-407: Inefficient Algorithmic Complexity in djangoproject Django

The vulnerability arises from the django.utils.http.parse_header_parameters() function's handling of HTTP header parameters. When parsing headers with many separators inside quoted parameters, the function exhibits quadratic time complexity, which can be exploited to cause a denial-of-service by exhausting server resources. This can be triggered by unauthenticated requests through headers like Accept or Content-Type, for example during content negotiation via HttpRequest.accepts(). Affected versions include Django 5.2 prior to 5.2.18, 6.0 prior to 6.0.9, and 6.1 prior to 6.1.2. The vulnerability is tracked as CWE-407 (Inefficient Algorithmic Complexity).

An attacker can cause a denial-of-service condition by sending crafted HTTP headers that trigger inefficient parsing in Django, potentially degrading or disrupting service availability. There is no impact on confidentiality or integrity. The attack requires no authentication and can be performed remotely over the network.

Fixed versions are available: Django 5.2.18, 6.0.9, and 6.1.2 address this issue. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation or workaround is specified. Patch status is confirmed by the affectedVersions field indicating fixed versions as the exclusive upper bounds.