PT-2026-30851 · Django+3 · Django+3

Jacob Walls + 2 · Published 2026-04-07 · Updated 2026-05-13 · CVE-2026-33034

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3

Description ASGI requests lacking or underreporting the Content-Length header may bypass the DATA UPLOAD MAX MEMORY SIZE limit when processing HttpRequest.body, potentially allowing attackers to upload an unrestricted request body into memory. Earlier, unsupported Django versions (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.

Recommendations Update to Django version 4.2.30 or later. Update to Django version 5.2.13 or later. Update to Django version 6.0.4 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-DJANGO-2026-33034

CVE-2026-33034

ECHO-01AC-8821-274A

GHSA-933H-HP56-HF7M

MGASA-2026-0093

OESA-2026-2217

OESA-2026-2218

OESA-2026-2219

OESA-2026-2220

OPENSUSE-SU-2026:10516-1

OPENSUSE-SU-2026:10517-1

OPENSUSE-SU-2026:10567-1

OPENSUSE-SU-2026:20578-1

PYSEC-2026-49

USN-8154-1

Affected Products

Django

Linuxmint

Red Os

Ubuntu

References · 57

• https://osv.dev/vulnerability/USN-8154-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-933h-hp56-hf7m · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2217 · Vendor Advisory
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4277 · Security Note
• https://ubuntu.com/security/CVE-2026-4292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35192 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10567-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2218 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33034 · Security Note
• https://ubuntu.com/security/CVE-2026-4277 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33034 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0093.html · Security Note