Read the docs
TI-2026-84388 Aliases CVE-2026-108147GHSA-9v48-h9hx-rjpv

Memory exhaustion in Django MultiPartParser via base64 file uploads

Priority LOW 37CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19 are affected. The django.http.multipartparser.MultiPartParser class buffers multipart file uploads with base64 Content-Transfer-Encoding entirely in memory before passing them to upload handlers, which allows excessive memory consumption (CWE-770). An unauthenticated remote attacker can exhaust server memory and degrade availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Ignacy Kujawa for reporting this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00579 47th percentileScored 2026-11-07
Fix Fixed Django (djangoproject): 6.1.3, 6.0, 6.0.10 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
djangoprojectDjango6.1 to before 6.1.3; 6.0.4 to before 6.0.10; 5.2.13 to before 5.2.196.1.3, 6.0, 6.0.10, 5.2, 5.2.19Patch availableCNA
  • Django Vendordjangoproject Affected 6.1 to before 6.1.3; 6.0.4 to before 6.0.10; 5.2.13 to before 5.2.19 Fixed in 6.1.3, 6.0, 6.0.10, 5.2, 5.2.19 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*——djangoproject
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions — — ·djangoproject

Remediation

Upgrade Django to 6.1.3, 6.0.10 or 5.2.19, which fix the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA Django (djangoproject) Fixed in 6.1.3, 6.0, 6.0.10, 5.2, 5.2.19

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    djangoproject Django — Django security releases issued: 6.1.3, 6.0.10, and 5.2.19

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2026-84393 Server-side request forgery in Django via SpatialReference string inputPriority LOW 37
    • TI-2026-84390 Server-side request forgery via crs member of GeoJSON geometriesPriority LOW 37
    • TI-2026-84389 Log injection via unescaped geometry form values in DjangoPriority LOW 31
    Show all 6 records → Advisory →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-108147
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Priority changed: MEDIUM → LOW
  4. 2026-11-03 Alias added: GHSA-9v48-h9hx-rjpv

References

Patch 4

Advisory 2

Other 1

  • TI-2022-15177 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. CVSS 3.1CRITICAL 9.8
  • TI-2020-05994 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection… CVSS 3.1CRITICAL 9.8
  • TI-2023-10198 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0… CVSS 3.1HIGH 7.5
  • TI-2019-14306 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. CVSS 3.1CRITICAL 9.8
  • TI-2019-10595 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x… CVSS 3.0CRITICAL 9.8
  • TI-2021-14006 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection… CVSS 3.1CRITICAL 9.8
See all 171 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences