CVE-2012-3443
Django Image Field Vulnerable to Image Decompression Bombs
CVE-2012-3443 is a medium vulnerability (CVSS 5.0) in Djangoproject Django, published July 31, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.66%, the 85th percentile. Fixed in django 1.3.2.
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
Exploit likelihood
What each source reports
NVD Score used
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
- Record
CVE-2012-3443- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
- Record
CVE-2012-3443- Updated
- 2026-11-02
EUVDEUVD-2012-0004 No score
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
- Record
EUVD-2012-0004- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-59w8-4wm2-4xw8
Django Image Field Vulnerable to Image Decompression Bombs
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
- Record
GHSA-59w8-4wm2-4xw8- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
OSVGHSA-59w8-4wm2-4xw8
Django Image Field Vulnerable to Image Decompression Bombs
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
- Record
GHSA-59w8-4wm2-4xw8- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
OSV No score
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
- Record
CVE-2012-3443- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-3443 No score
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
- Record
DEBIAN-CVE-2012-3443- Updated
- 2026-11-02
OSVPYSEC-2012-3 No score
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
- Record
PYSEC-2012-3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
before 1.3.2 | 1.3.2 |
djangoPyPI |
1.4 up to 1.4.1 | 1.4.1 |
python-djangoDebian:12 |
before 1.4.1-1 | 1.4.1-1 |
python-djangoDebian:13 |
before 1.4.1-1 | 1.4.1-1 |
python-djangoDebian:14 |
before 1.4.1-1 | 1.4.1-1 |
python-djangoDebian:6.0 |
before 1.2.3-3+squeeze3, plus listed versions 1.2.3-31.2.3-3+squeeze11.2.3-3+squeeze2 |
1.2.3-3+squeeze3 |
djangoPyPI |
before 1.3.2, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 14 moreShow less1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.1 |
1.3.2 |
djangoPyPI |
before 1.3.2, 1.4 up to 1.4.1, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 14 moreShow less1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.1 |
1.3.21.4.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2012/07/31/1
djangoproject.com/weblog/2012/jul/30/security-releases-issued
mandriva.com/security/advisories?name=MDVSA-2012:143
ubuntu.com/usn/USN-1560-1
debian.org/security/2012/dsa-2529
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-3443
github.com/django/django/commit/9ca0ff6268eeff92d0d0ac2c315d4b6a8e229155
security-tracker.debian.org/tracker/CVE-2012-3443