CVE-2026-33034

Django CVE-2026-33034 affects ASGI request handling: missing/undersized Content-Length can bypass DATA_UPLOAD_MAX_MEMORY_SIZE when reading HttpRequest.body, allowing loading of an unbounded request body. Affected: Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30; earlier series (...

CVE-2026-33034 Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATAUPLOADMAXMEMORYSIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into...

PT-2026-30851

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.29, 5.2 through 5.2.12, and 6.0 through 6.0.3 Description ASGI requests lacking or underreporting the Content-Length header may bypass the DATA UPLOAD MAX MEMORY SIZE limit when processing HttpRequest.body,...