CVE-2026-84429

Executive Summary

CVE-2026-84429 is a denial-of-service vulnerability in Django's django.utils.http.parse_header_parameters() function, which exhibits quadratic (O(n²)) time complexity when parsing a quoted parameter that contains many separators. Any unauthenticated client can trigger it by sending a crafted Accept or Content-Type header, including indirectly through content negotiation performed by HttpRequest.accepts(). Because the per-call length limit does not bound the combined size of repeated headers, an attacker can amplify CPU consumption and degrade or exhaust worker processes on affected Django deployments (6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18).

Technical Analysis

The vulnerability resides in Django's HTTP header parsing utility django.utils.http.parse_header_parameters(). According to the NVD description, the function is subject to quadratic time complexity when it parses "a value with many separators inside a quoted parameter." In algorithmic terms, the parser's work grows proportionally to the square of the input length for this input class (CWE-407: Inefficient Algorithmic Complexity), meaning that a roughly linear increase in attacker-supplied input produces a quadratically larger amount of processing effort.

The attack surface is the request header layer of any Django application. The parsing path is reachable from standard HTTP headers such as Accept and Content-Type — headers that virtually every web application accepts and that are frequently parsed before any authentication or authorization check occurs. The description specifically notes that the parsing can be reached "via the content negotiation performed by HttpRequest.accepts()," a method commonly invoked by application code and middleware to select a response format.

Two properties combine to make the issue exploitable at scale:

1. Quoted-parameter separator explosion. The parser's inefficient path is triggered when a quoted parameter inside a header value contains many separators. An attacker controls both the number of separators and the length of the quoted string, so they can dial the per-request cost upward until a single request consumes disproportionate CPU time.

2. Repeated-header amplification. The description explicitly states that "the per-call length limit does not bound the combined size of repeated headers." Many HTTP servers accept a header sent multiple times and concatenate or forward the values; because the limit applies per call rather than to the aggregate, an attacker can send numerous headers, each individually within limits, whose combined parsed size is far larger than any single-header guard would permit. This converts a bounded per-request cost into a much larger aggregate cost per client connection.

Because the parse occurs during request processing, each expensive parse occupies a worker thread or process for the duration of the computation. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects that the flaw is network-reachable, requires no privileges or user interaction, does not affect confidentiality or integrity, and has a limited availability impact per the scoring rubric — however, sustained or concurrent abuse can accumulate into a service-level outage depending on deployment capacity.

It should be noted that Accept and Content-Type are routinely present in benign traffic, so a naive "header present" detection is insufficient; the distinguishing factor is header size/structure combined with request rate. No public proof-of-concept, Nuclei template, or exploit code is available, and no patch evidence from tracked sources exists (patch confidence 0/4).

Exploitation Scenarios

The following attack chain is inferred strictly from the vulnerability class (denial of service via inefficient algorithmic complexity) and the details in the NVD description. No public PoC is available.

1. Reconnaissance / target identification. The attacker identifies internet-exposed or internally reachable Django applications. Django leaves characteristic fingerprints (cookie names such as those issued by session middleware, admin login pages, and static asset paths), and version disclosure may allow the attacker to determine whether the target falls in the affected ranges (6.1 before 6.1.2, 6.0 before 6.0.9, 5.2 before 5.2.18). Any endpoint that performs content negotiation or inspects request headers — effectively any Django view — is a candidate.

2. Triggering the flaw class. The attacker sends an HTTP request containing an Accept or Content-Type header whose value includes a quoted parameter containing a large number of separators. Because the parser's complexity is quadratic in this input class, the cost to the server rises sharply as the separator count grows. The attacker may also exploit the documented weakness that per-call length limits do not bound the combined size of repeated headers, sending the header multiple times so that the aggregate parsed size exceeds any single-header guard.

3. Execution method (vulnerability-class level). No special payload encoding beyond the quoted-parameter-with-separators structure is required. The attacker needs only standard HTTP requests — no authentication, no session, no user interaction, consistent with PR:N and UI:N in the CVSS vector. Requests can be issued from a single client or distributed across many clients. HttpRequest.accepts()-based content negotiation provides one documented internal path by which application code hands attacker-supplied header values to the vulnerable parser.

4. Post-exploitation impact. Successful abuse consumes server CPU and ties up request-handling workers for the duration of each expensive parse. If request volume and header size are sustained, response latency increases for legitimate users, request queues fill, and the application can become unresponsive — a denial-of-service condition. There is no data disclosure, modification, or code execution implied by the flaw: the CVSS vector rates C:N and I:N. Any broader compromise would require a separate vulnerability not described here.

Impact Assessment

The vulnerability's direct impact is availability degradation on Django application servers. The CVSS 3.1 base score is 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L:

• AV:N (Network) — exploitable across the network; no local access required.
• AC:L (Low) — no special conditions or race windows are needed; the attacker simply sends crafted headers.
• PR:N / UI:N — no authentication and no user interaction, so the entire unauthenticated request surface is exposed.
• S:U (Unchanged) — impact is confined to the vulnerable Django component.
• C:N / I:N — no confidentiality or integrity impact.
• A:L (Low) — limited availability impact per the scoring rubric.

Business impact derives from the potential for repeated or high-volume requests to exhaust worker capacity. Affected systems include any web application or API built on the affected Django releases, including internal services that are reachable by lower-trust network segments. Because content negotiation and header inspection are pervasive, the vulnerable code path is not limited to a single optional feature. Blast radius is proportional to how much attacker-controlled request volume the target can absorb: single-worker or small-footprint deployments degrade fastest, while horizontally scaled deployments with aggressive rate limiting are more resilient but not immune. Earlier unsupported series (5.1.x, 5.0.x, 4.2.x) were not evaluated by the reporter and may also be affected, widening the potential exposure for organizations running legacy releases.

No threat-actor campaign or in-the-wild exploitation evidence is associated with this CVE in the provided data, and it is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Potential Django parse_header_parameters DoS via Oversized or Repeated Accept/Content-Type Headers
id: 8b1f4c2e-3d7a-4f6b-9c2e-django84429a
status: experimental
description: Detects requests to Django applications with abnormally large or repeated Accept/Content-Type headers consistent with CVE-2026-84429 quadratic parsing abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84429
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
      - HEAD
      - PUT
  selection_headers:
    - cs-header|contains:
        - 'Accept:'
        - 'Content-Type:'
  timeframe: 5m
  condition: selection_method and selection_headers | count() by src_ip > 50
fields:
  - src_ip
  - cs-uri-stem
  - cs-header
falsepositives:
  - Legitimate clients with unusually verbose Accept headers
  - Application health checks and crawlers
level: medium

YARA Rule

rule CVE_2026_84429_Django_Header_DoS
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP requests abusing Django parse_header_parameters quadratic complexity (CVE-2026-84429)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84429"
        date = "2026-01-01"

    strings:
        $accept = "Accept:" ascii nocase
        $ctype  = "Content-Type:" ascii nocase
        $sep1   = ";" ascii
        $quote  = "\"" ascii

    condition:
        (uint16(0) == 0x4854) and
        ($accept or $ctype) and
        $quote and
        #sep1 > 32
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84429 Django parse_header_parameters DoS attempt (oversized/repeated Accept or Content-Type header)"; flow:established,to_server; http.header_names; content:"Accept"; nocase; threshold: type both, track by_src, count 40, seconds 60; classtype:attempted-dos; reference:cve,2026-84429; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-84429; sid:90084429; rev:1;)

alert http any any -> any any (msg:"CVE-2026-84429 Django content negotiation header abuse"; flow:established,to_server; pcre:"/^(Accept|Content-Type)\x3a[^\r\n]*(;[^\r\n]*){32,}/mi"; classtype:attempted-dos; reference:cve,2026-84429; sid:90084430; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [http where http.request.method in ("GET","POST","HEAD","PUT") and
       (http.request.headers contains "Accept" or http.request.headers contains "Content-Type")]
  [http where http.request.method in ("GET","POST","HEAD","PUT") and
       (http.request.headers contains "Accept" or http.request.headers contains "Content-Type")]
  [http where http.request.method in ("GET","POST","HEAD","PUT") and
       (http.request.headers contains "Accept" or http.request.headers contains "Content-Type")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval ct=coalesce(content_type, http_content_type)
| eval acc=coalesce(accept, http_accept)
| eval hdr_len=len(ct)+len(acc)
| eval sep_count=(len(ct)-len(replace(ct,";","")))+(len(acc)-len(replace(acc,";","")))
| where hdr_len > 1024 OR sep_count > 32
| stats count AS requests, avg(hdr_len) AS avg_hdr_len, max(sep_count) AS max_seps, values(uri) AS uris
        by clientip
| where requests > 30
| sort - max_seps
| table clientip, requests, avg_hdr_len, max_seps, uris

Wazuh OSSEC Rule

<group name="web,django,cve-2026-84429">
  <rule id="10084429" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <description>CVE-2026-84429: High volume of requests with oversized/repeated Accept or Content-Type headers against Django application (possible DoS)</description>
    <field name="url">\.</field>
    <regex>^(Accept|Content-Type):.*(;[^;]*){32,}</regex>
    <frequency>40</frequency>
    <timeframe>60</timeframe>
    <same_source_ip />
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, affected-version mapping, or OSV package data was retrieved from the tracked sources, and no explicit patch reference was provided. The NVD description indicates the fixes are delivered in Django 6.1.2, 6.0.9, and 5.2.18, but this has not been corroborated by any tracked patch source.

1) Immediate mitigations (attack-surface reduction while awaiting a confirmed patch):

• Deploy a reverse proxy or WAF in front of Django and enforce a hard cap on total request header size (aggregate across all repeated header lines), not merely a per-line limit. The CVE specifically notes that per-call length limits do not bound repeated headers, so aggregate enforcement is essential.
• Reject or truncate Accept and Content-Type values that exceed expected length or that contain an anomalous number of separators within a quoted parameter.
• Normalize repeated headers at the proxy layer: collapse duplicate Accept/Content-Type headers into a single bounded value before forwarding to the application.
• Apply aggressive per-client rate limiting and connection/request concurrency caps on unauthenticated endpoints.
• Front key endpoints with a caching CDN where responses are static, reducing Django worker exposure.

2) Patch/upgrade steps:

• Upgrade to Django 6.1.2 or later, 6.0.9 or later, or 5.2.18 or later, per the versions named in the NVD description.
• Organizations on the unevaluated earlier series (5.1.x, 5.0.x, 4.2.x) should treat those deployments as potentially affected and migrate to a supported, patched release.
• Verify the deployed version after upgrade and confirm the fix is present in django.utils.http.parse_header_parameters() behavior under repeated-header test conditions.
• Because patch confidence is currently 0/4 and no patch source was tracked, treat the version guidance as advisory pending independent confirmation and vendor advisory verification.

3) Long-term hardening:

• Treat HTTP headers as untrusted input with strict, aggregate size and complexity bounds enforced at the edge.
• Instrument server CPU and request latency per endpoint to baseline and alarm on parsing-path anomalies.
• Maintain a Django upgrade cadence aligned with supported releases; retire unsupported series promptly.
• Add regression tests for header-parsing complexity and repeated-header aggregation to CI.
• Apply defense-in-depth so that content negotiation and header inspection are never the sole gate before expensive processing.

References

• NVD — CVE-2026-84429: https://nvd.nist.gov/vuln/detail/CVE-2026-84429
• Django security releases (official advisories and release notes for 6.1.2 / 6.0.9 / 5.2.18): https://www.djangoproject.com/weblog/ (consult the release announcement corresponding to these versions)
• Django project security policy and supported versions: https://www.djangoproject.com/security/
• CWE-407 — Inefficient Algorithmic Complexity: https://cwe.mitre.org/data/definitions/407.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor information: None available in the provided data. No exploit-in-the-wild evidence and no CISA KEV listing were identified for this CVE; the reporter credited by the vendor is Jisung Chae.