PT-2026-30851 · Django+3 · Django+3
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3
Description
ASGI requests lacking or underreporting the
Content-Length header may bypass the DATA UPLOAD MAX MEMORY SIZE limit when processing HttpRequest.body, potentially allowing attackers to upload an unrestricted request body into memory. Earlier, unsupported Django versions (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.Recommendations
Update to Django version 4.2.30 or later.
Update to Django version 5.2.13 or later.
Update to Django version 6.0.4 or later.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Django
Linuxmint
Red Os
Ubuntu