NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
HIGH severity

Django vulnerable to Improper Restriction of Operations within the Bounds of a Memory BufferGHSA-5h2q-4hrp-v9rr

HIGHFix: django/django@9ca0ff6

GHSA-5h2q-4hrp-v9rr is a high-severity (CVSS 7.5) Buffer Overflow vulnerability in django. A fix is available for django — see the affected versions and patch details below.

Also known asCVE-2012-3444PYSEC-2012-4
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 12, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.8%probability of exploitation in next 30 days
Lower Risk-0.01%
Lower risk than most CVEs78th percentile — riskier than 78% of all scored CVEsHighest risk
0.69%1.22%1.76%2.29%1.2%1.8%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected
🐍django🐍django

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIdjangoall versions1.3.2pip install --upgrade 'django==1.3.2'
🐍PyPIdjango≥ 1.4&&< 1.4.11.4.1pip install --upgrade 'django==1.4.1'

Affected Products

1 product · 29 configurations
Application
djangodjangoproject
≤ 1.3
18 versions
0.950.961.01.0.11.0.21.11.1.21.1.31.1.41.21.2-alpha11.2.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for django, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update django to 1.3.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5h2q-4hrp-v9rr is resolved across your whole dependency graph.

  3. Workarounds

    Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Ubuntu
USN-1560-1Ubuntu

Frequently Asked Questions

The `get_image_dimensions` function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image.
O3 Security · Impact-Aware SCA

Is GHSA-5h2q-4hrp-v9rr in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
Django vulnerable to Improper Restriction of Operations…