Django EUVD-2026-93416

Requires that Django internationalization is active so that get_supported_language_variant() processes attacker-supplied language codes - i.e. USE_I18N enabled (the default) with language negotiation driven by the Accept-Language header, a language URL prefix, or the LocaleMiddleware. The attacker must send many distinct, very long language codes so that each is retained as a unique key in the in-memory LRU cache before length limiting. Limiting factors: impact is gradual memory growth (A:L), not an instant crash, so sustained request volume is needed; sites that disable i18n or sit behind a proxy/WAF that normalizes or caps Accept-Language header length are largely unaffected; only unsupported/affected versions prior to 5.2.18 / 6.0.9 / 6.1.2 are vulnerable.

This is a low-to-moderate severity denial-of-service issue (CVSS 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), classified under CWE-789 (memory allocation with excessive size). The signals are internally consistent and point to genuine but bounded risk: the network vector with low complexity and no privileges/interaction makes it remotely reachable, but the impact is confined to availability only (C:N/I:N/A:L) - there is no code execution, data exposure, or integrity impact. The Django security team itself rated this 'low' per its own severity policy, which aligns with the A:L (low availability) rating rather than A:H. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; the only confirmed exploitation signal is the vendor-documented attack vector. The practical risk is memory growth over time rather than instant crash - an attacker must send many distinct, very long language codes to bloat the in-memory LRU cache. Note the tag 'Information Disclosure' conflicts with the CVSS vector (C:N means no confidentiality impact); this is a memory-exhaustion DoS, not an information-disclosure flaw. This is a 'patch in normal maintenance cycle' issue for most deployments, not an emergency, though internet-facing i18n-enabled sites should prioritize it higher.

An attacker sends a stream of HTTP requests to an internationalized Django site, each carrying a unique, very long value in the Accept-Language header (or language parameter). Because language codes were cached as keys before length validation, each distinct long code is retained in process memory, gradually exhausting available RAM and degrading or crashing the worker process. No authentication or user interaction is required (PR:N/UI:N), and no public exploit code was identified at time of analysis.