{"title":"Django 3.2.17 release notes","version":"dev","locale":"en","docname":"releases/3.2.17","url":"/en/dev/releases/3.2.17/","canonical":"https://djangodocs.dev/en/dev/releases/3.2.17/","summary":"Django 3.2.17 fixes a security issue with severity “moderate” in 3.2.16. The parsed values of Accept-Language headers are cached in order to avoid…","html":"<h1>Django 3.2.17 release notes<a class=\"heading-anchor\" href=\"#django-3-2-17-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>February 1, 2023</em></p>\n<p>Django 3.2.17 fixes a security issue with severity “moderate” in 3.2.16.</p>\n<section id=\"cve-2023-23969-potential-denial-of-service-via-accept-language-headers\">\n<h2>CVE-2023-23969: Potential denial-of-service via <code class=\"docutils literal notranslate\">Accept-Language</code> headers<a class=\"heading-anchor\" href=\"#cve-2023-23969-potential-denial-of-service-via-accept-language-headers\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>The parsed values of <code class=\"docutils literal notranslate\">Accept-Language</code> headers are cached in order to avoid\nrepetitive parsing. This leads to a potential denial-of-service vector via\nexcessive memory usage if large header values are sent.</p>\n<p>In order to avoid this vulnerability, the <code class=\"docutils literal notranslate\">Accept-Language</code> header is now\nparsed up to a maximum length.</p>\n</section>","rootId":"django-3-2-17-release-notes","toc":[{"title":"CVE-2023-23969: Potential denial-of-service via Accept-Language headers","anchor":"cve-2023-23969-potential-denial-of-service-via-accept-language-headers","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/3.2.18","title":"Django 3.2.18 release notes","url":"/en/dev/releases/3.2.18/"},"next":{"docname":"releases/3.2.16","title":"Django 3.2.16 release notes","url":"/en/dev/releases/3.2.16/"},"formats":{"html":"/en/dev/releases/3.2.17/","markdown":"/en/dev/releases/3.2.17.md","json":"/en/dev/releases/3.2.17.json"},"source":"https://github.com/django/django/blob/main/docs/releases/3.2.17.txt","official":"https://docs.djangoproject.com/en/dev/releases/3.2.17/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2"],"inLocales":["en"]}