{"action":"Upgrade django to 3.2.17 or later.","affected":[{"fixed":"3.2.17","introduced":"3.2"},{"fixed":"4.0.9","introduced":"4.0"},{"fixed":"4.1.6","introduced":"4.1"}],"component":"django","cve_ids":["CVE-2023-23969"],"ecosystem":"PyPI","epss":0.47381,"exploited":false,"fixed_versions":["3.2.17","4.0.9","4.1.6"],"ghsa_id":"GHSA-q2jf-h9jm-m7p4","id":"tcs_01M5KGJCEWDMQ63H2BYG1Q2RAZ","modified_at":"2026-06-10T17:01:02.189898268Z","published_at":"2023-02-01T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-12","https://docs.djangoproject.com/en/4.1/releases/security/","https://www.djangoproject.com/weblog/2023/feb/01/security-releases/","https://groups.google.com/forum/#!forum/django-announce","https://github.com/advisories/GHSA-q2jf-h9jm-m7p4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-12","url":"https://osv.dev/vulnerability/PYSEC-2023-12"}],"summary":"In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-s"}