1. ===========================
    
  2. Django 3.2.17 release notes
    
  3. ===========================
    
  4. 
    
  5. *February 1, 2023*
    
  6. 
    
  7. Django 3.2.17 fixes a security issue with severity "moderate" in 3.2.16.
    
  8. 
    
  9. CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers
    
  10. ===========================================================================
    
  11. 
    
  12. The parsed values of ``Accept-Language`` headers are cached in order to avoid
    
  13. repetitive parsing. This leads to a potential denial-of-service vector via
    
  14. excessive memory usage if large header values are sent.
    
  15. 
    
  16. In order to avoid this vulnerability, the ``Accept-Language`` header is now
    
  17. parsed up to a maximum length.