The django.forms.ImageField
class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
{ "nvd_published_at": "2012-07-31T17:55:00Z", "cwe_ids": [ "CWE-20", "CWE-400" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-08-29T22:31:03Z" }