CVE-2023-28837

2 advisories.

PyPI/wagtail CVE-2023-28837: medium 4.4, EPSS 1.07%

Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

Action: Upgrade wagtail to 4.1.4 or later.

pip install wagtail==4.2.2

pip install wagtail==4.1.4

Affected

introduced	fixed	last affected
4.2	4.2.2	-
0	4.1.4	-

Fixed versions

4.2.2

4.1.4

Sources

osv: GHSA-33pv-vcgh-jfg9
https://github.com/wagtail/wagtail/security/advisories/GHSA-33pv-vcgh-jfg9
https://nvd.nist.gov/vuln/detail/CVE-2023-28837
https://github.com/wagtail/wagtail/commit/3c0c64642b9e5b8d28b111263c7f4bddad6c3880
https://github.com/wagtail/wagtail/commit/c9d2fcd650a88d76ae122646142245e5927a9165
https://github.com/wagtail/wagtail/commit/cfa11bbe00dbe7ce8cd4c0bbfe2a898a690df2bf
https://github.com/wagtail/wagtail/commit/d4022310cbe497993459c3136311467c7ac6329a
https://docs.wagtail.org/en/stable/reference/settings.html#wagtailimages-max-upload-size
https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2023-56.yaml
https://github.com/wagtail/wagtail
https://github.com/wagtail/wagtail/releases/tag/v4.1.4
https://github.com/wagtail/wagtail/releases/tag/v4.2.2

CVE-2023-28837 · published 2023-04-03T19:18:09Z · modified 2026-09-10T03:49:53.230639651Z · JSON

PyPI/wagtail CVE-2023-28837: unknown, EPSS 1.07%

Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both