Changes between Version 12 and Version 13 of SecurityTeam

Timestamp:

Nov 21, 2025, 6:26:48 AM (2 weeks ago)

Author:

Natalia Bidart

Comment:

Add common response for parse_header_parameters

SecurityTeam

@@ -114 +114 @@
 Kind regards, the Django Security Team.
 
-=== Maximum password validator (lack of) ==
+=== Maximum password validator (lack of) ===
 
 Thank you for your report. We reviewed the issue and do not consider it a security vulnerability.
@@ -141 +141 @@
 [0] https://docs.djangoproject.com/en/stable/ref/settings/#data-upload-max-memory-size
 
+=== HTTP Content-Type Header parsing (parse_header_parameters) ===
+
+Thank you for your report. This problem has already been reported a few times in the past. The security team does not consider this to be a vulnerability, and work towards improving the handling of strings containing a large number of separators by `parse_header_parameters` has been happening in public[0]. We invite you to join this effort.
+
+Kind regards, the Django Security Team.
+
+[0] https://code.djangoproject.com/ticket/35440
+
 === Unauthenticated cache purge ===