{"action":"Upgrade django to 3.2.21 or later.","affected":[{"fixed":"3.2.21","introduced":"3.2"},{"fixed":"4.1.11","introduced":"4.1"},{"fixed":"4.2.5","introduced":"4.2"}],"component":"django","cve_ids":["CVE-2023-41164"],"ecosystem":"PyPI","epss":0.01519,"exploited":false,"fixed_versions":["3.2.21","4.1.11","4.2.5"],"ghsa_id":"GHSA-7h4p-27mh-hmrw","id":"tcs_01M5KGJZYNK8RVWNTV7CFR4HSQ","modified_at":"2026-06-10T17:01:02.864153219Z","published_at":"2023-11-03T05:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-225","https://www.djangoproject.com/weblog/2023/sep/04/security-releases/","https://docs.djangoproject.com/en/4.2/releases/security/","https://groups.google.com/forum/#!forum/django-announce","https://github.com/advisories/GHSA-7h4p-27mh-hmrw"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-225","url":"https://osv.dev/vulnerability/PYSEC-2023-225"}],"summary":"In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large n"}