PyPI/wagtail CVE-2023-28837: medium 4.4, EPSS 1.07%

Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

Action: Upgrade wagtail to 4.1.4 or later.

pip install wagtail==4.2.2

pip install wagtail==4.1.4

Affected

Fixed versions

Sources

• osv: GHSA-33pv-vcgh-jfg9
• https://github.com/wagtail/wagtail/security/advisories/GHSA-33pv-vcgh-jfg9
• https://nvd.nist.gov/vuln/detail/CVE-2023-28837
• https://github.com/wagtail/wagtail/commit/3c0c64642b9e5b8d28b111263c7f4bddad6c3880
• https://github.com/wagtail/wagtail/commit/c9d2fcd650a88d76ae122646142245e5927a9165
• https://github.com/wagtail/wagtail/commit/cfa11bbe00dbe7ce8cd4c0bbfe2a898a690df2bf
• https://github.com/wagtail/wagtail/commit/d4022310cbe497993459c3136311467c7ac6329a
• https://docs.wagtail.org/en/stable/reference/settings.html#wagtailimages-max-upload-size
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2023-56.yaml
• https://github.com/wagtail/wagtail
• https://github.com/wagtail/wagtail/releases/tag/v4.1.4
• https://github.com/wagtail/wagtail/releases/tag/v4.2.2

CVE-2023-28837 · published 2023-04-03T19:18:09Z · modified 2026-09-10T03:49:53.230639651Z · JSON