UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28837

Denial-of-service via memory exhaustion when uploading large files

Severity
Medium 4.9
Published
3 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.1.4, 4.2.2
Also known as
GHSA-33pv-vcgh-jfg9
Sources
NVD, Project advisories (GitHub)

Description

Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A user with access to upload images or documents through the Wagtail admin interface could upload a file…

Affected software

SoftwareAffected versions
WagtailServers and applications · cpe:a:torchbox:wagtail
  • Every version before 4.1.4
  • From 4.2 before 4.2.2
WagtailServers and applications · github:wagtail/wagtail
  • Version 4.2
  • Version 4.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28837
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28837
  • GitHub Advisory Database https://github.com/advisories/GHSA-33pv-vcgh-jfg9
  • github.com https://github.com/wagtail/wagtail/security/advisories/GHSA-33pv-vcgh-jfg9