Plattform
python
Komponente
django
Behoben in
6.0.4
5.2.13
4.2.30
6.0.4
4.2.30
4.2.30
CVE-2026-33034 describes a memory exhaustion vulnerability discovered in Django versions 6.0, 5.2, and 4.2. Attackers can exploit this flaw by crafting ASGI requests with missing or understated Content-Length headers, bypassing the DATAUPLOADMAXMEMORYSIZE limit and potentially causing a denial-of-service. The vulnerability impacts versions prior to 6.0.4, 5.2.13, and 4.2.30, and a fix has been released.
This vulnerability allows a remote attacker to bypass Django's memory limits for uploaded data. By sending a request with a manipulated Content-Length header, an attacker can force Django to load an arbitrarily large request body into memory. This can lead to a denial-of-service (DoS) condition, potentially crashing the Django application or exhausting server resources. The impact is particularly severe in environments where Django handles user-uploaded files or processes large data payloads. While the description doesn't explicitly mention data exfiltration, the memory exhaustion could be a precursor to other attacks, such as attempting to overload the system and gain access to sensitive information.
This vulnerability was publicly disclosed on 2026-04-07. There is currently no indication of active exploitation in the wild, but the ease of exploitation and the potential for DoS attacks warrant immediate attention. The vulnerability is not listed on CISA KEV as of this writing. Superior reported the issue, indicating a proactive security research effort.
Web applications using Django versions 6.0, 5.2, or 4.2 are at risk, particularly those that handle user-uploaded files or process large data payloads. Shared hosting environments running vulnerable Django applications are also at increased risk due to the potential for cross-tenant attacks.
• python / server:
# Check for vulnerable Django versions
python -c 'import django; print(django.get_version())'• python / server:
# Examine ASGI middleware for Content-Length validation
# (Review your custom middleware code)• generic web:
# Check Django application logs for errors related to Content-Length or memory limits
# (Look for exceptions related to exceeding DATA_UPLOAD_MAX_MEMORY_SIZE)disclosure
Exploit-Status
EPSS
0.03% (9% Perzentil)
CVSS-Vektor
The primary mitigation is to upgrade Django to a patched version: 6.0.4, 5.2.13, or 4.2.30. If upgrading immediately is not feasible, consider implementing a temporary workaround by strictly validating the Content-Length header in your ASGI middleware. This could involve rejecting requests with missing or suspiciously small headers. Additionally, review your DATAUPLOADMAXMEMORYSIZE setting to ensure it is appropriately configured to limit the amount of memory consumed by uploaded data. After upgrade, confirm the fix by sending a test request with a deliberately oversized Content-Length header and verifying that Django correctly rejects it.
Actualice Django a la versión 6.0.4, 5.2.13 o 4.2.30 o superior para mitigar la vulnerabilidad. Esta actualización corrige un problema que permite a los atacantes cargar cuerpos de solicitud ilimitados en la memoria, lo que podría provocar una denegación de servicio. Consulte las notas de la versión para obtener más detalles.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2026-33034 is a HIGH severity vulnerability affecting Django versions ≤6.0.3, 5.2≤5.2.13, and 4.2≤4.2.30. It allows attackers to bypass memory limits by manipulating Content-Length headers, potentially leading to a denial-of-service.
If you are using Django versions 6.0, 5.2, or 4.2 prior to 6.0.4, 5.2.13, or 4.2.30, respectively, you are potentially affected by this vulnerability.
Upgrade Django to version 6.0.4, 5.2.13, or 4.2.30. As a temporary workaround, implement strict Content-Length header validation in your ASGI middleware.
There is currently no public evidence of active exploitation, but the vulnerability's ease of exploitation warrants immediate action.
Refer to the official Django security advisory for detailed information and updates: [https://www.djangoproject.com/security/](https://www.djangoproject.com/security/)
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine requirements.txt-Datei hoch und wir sagen dir sofort, ob du betroffen bist.