PT-2026-30850 · Djangoproject · Django

Jacob Walls + 2 · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-33033

Mitre

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with Content-Transfer-Encoding: base64 including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2026-33033

Affected Products

Django

References · 4

• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://djangoproject.com/weblog/2026/apr/07/security-releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33033 · Security Note
• https://groups.google.com/g/django-announce · Note