Django · Django · CVE-2026-33034
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3
Description
ASGI requests lacking or underreporting the `Content-Length` header may bypass the `DATA UPLOAD MAX MEMORY SIZE` limit when processing `HttpRequest.body`, potentially allowing attackers to upload an unrestricted request body into memory. Earlier, unsupported Django versions (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.
Recommendations
Update to Django version 4.2.30 or later.
Update to Django version 5.2.13 or later.
Update to Django version 6.0.4 or later.