Collected research

James Bennett -- Django DOS

Patches for Django Framework Fix DoS Vulnerability

Chris Brook · Threatpost | The first stop for security news · 17 September 2013

Django hashed submitted passwords with no length cap, so repeatedly posting very large passwords tied servers up in PBKDF2 work - about a minute for a one-megabyte password. Releases 1.4.8, 1.5.4 and 1.6 beta 4 reject authentication above 4096 bytes (CVE-2013-1443). The flaw was disclosed publicly on the developers' mailing list, forcing an out-of-band release.

Record

Document

Patches for Django Framework Fix DoS Vulnerability

Researcher

Chris Brook

Published by

Threatpost | The first stop for security news

Date

17 September 2013

Topic

Other

In the archive

• Collected in the 2013 research round

Tags

• django
• python
• dos
• algorithmic-complexity
• cve
• vendor-advisory
• mitigation
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Chris Brook, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.