Unscored severity · published Jul 31, 2012
CVE-2012-3443
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote…
–
CVSS
2.7%
EPSS
No
On KEV
Description
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DJ
Django · Djangoproject
through 1.3; 0.95; 0.96; 1.0; 1.0; 1.0; +23 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3443
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3443
www.debian.org
http://www.debian.org/security/2012/dsa-2529
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2012:143
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/07/31/1
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/07/31/2
www.ubuntu.com
http://www.ubuntu.com/usn/USN-1560-1
Patch
https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/
More from Django
9.8
CVE-2026-4277
Privilege abuse in GenericInlineModelAdmin
9.8
CVE-2025-59681
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7
9.8
CVE-2024-53908
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17
9.8
CVE-2023-31047
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files
9.8
CVE-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6