Broken Function Level Authorization

Broken Function Level Authorization in Django [March 2026] [CVE-2007-5712]

[Updated March 2026] Updated CVE-2007-5712

Overview

CVE-2007-5712 demonstrates that Django's i18n framework, when USE_I18N and the i18n component are enabled, can be exploited to cause a denial of service via many HTTP requests with large Accept-Language headers. While not a classic Broken Function Level Authorization (BFLA) issue in itself, this vulnerability highlights how misconfigurations and heavy input parsing in a web framework can degrade availability and complicate access controls. Attackers can exhaust server resources by flooding i18n language negotiation paths, potentially impacting authenticated and unauthenticated users alike. The patch for this issue reduced the risk by constraining or avoiding unbounded header processing, and developers should treat this as a reminder to enforce explicit, per-view authorization and input boundary checks when exposing sensitive endpoints. This guide links the CVE to practical remediation in Django and focuses on explicit function-level permission controls alongside input safeguards to mitigate related risks.

Affected Versions

Django core: 0.91, 0.95, 0.95.1, 0.96; also observed in PyLucid and other apps using Django i18n with USE_I18N enabled

Code Fix Example

Django API Security Remediation
Vulnerable pattern:

def vulnerable_view(request):
    from django.utils import translation
    # Vulnerable: passing the entire Accept-Language header into i18n processing
    accept_language = request.META.get('HTTP_ACCEPT_LANGUAGE', '')
    translation.activate(accept_language)  # potential DoS with very long headers
    return HttpResponse('OK')

Fixed pattern:

def fixed_view(request):
    from django.utils import translation
    accept_language = request.META.get('HTTP_ACCEPT_LANGUAGE', '')
    # Sanitize by taking only the first language token
    first_lang = accept_language.split(',')[0].split(';')[0].strip() if accept_language else 'en'
    translation.activate(first_lang)
    return HttpResponse('OK')

CVE References

Choose which optional cookies to allow. You can change this any time.