Platform
python
Component
django
Fixed in
6.0.4
5.2.13
4.2.30
6.0.4
4.2.30
4.2.30
CVE-2026-33034 describes a memory exhaustion vulnerability discovered in Django versions 6.0, 5.2, and 4.2. Attackers can exploit this flaw by crafting ASGI requests with missing or understated Content-Length headers, bypassing the DATAUPLOADMAXMEMORYSIZE limit and potentially causing a denial-of-service. The vulnerability impacts versions prior to 6.0.4, 5.2.13, and 4.2.30, and a fix has been released.
This vulnerability allows a remote attacker to bypass Django's memory limits for uploaded data. By sending a request with a manipulated Content-Length header, an attacker can force Django to load an arbitrarily large request body into memory. This can lead to a denial-of-service (DoS) condition, potentially crashing the Django application or exhausting server resources. The impact is particularly severe in environments where Django handles user-uploaded files or processes large data payloads. While the description doesn't explicitly mention data exfiltration, the memory exhaustion could be a precursor to other attacks, such as attempting to overload the system and gain access to sensitive information.
This vulnerability was publicly disclosed on 2026-04-07. There is currently no indication of active exploitation in the wild, but the ease of exploitation and the potential for DoS attacks warrant immediate attention. The vulnerability is not listed on CISA KEV as of this writing. Superior reported the issue, indicating a proactive security research effort.
Exploit Status
EPSS
0.03% (9% percentile)
CVSS Vector
The primary mitigation is to upgrade Django to a patched version: 6.0.4, 5.2.13, or 4.2.30. If upgrading immediately is not feasible, consider implementing a temporary workaround by strictly validating the Content-Length header in your ASGI middleware. This could involve rejecting requests with missing or suspiciously small headers. Additionally, review your DATAUPLOADMAXMEMORYSIZE setting to ensure it is appropriately configured to limit the amount of memory consumed by uploaded data. After upgrade, confirm the fix by sending a test request with a deliberately oversized Content-Length header and verifying that Django correctly rejects it.
Update Django to version 6.0.4, 5.2.13, or 4.2.30 or later to mitigate the vulnerability. This update fixes an issue that allows attackers to load unbounded request bodies into memory, which could lead to a denial of service. See the release notes for more details.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-33034 is a HIGH severity vulnerability affecting Django versions ≤6.0.3, 5.2≤5.2.13, and 4.2≤4.2.30. It allows attackers to bypass memory limits by manipulating Content-Length headers, potentially leading to a denial-of-service.
If you are using Django versions 6.0, 5.2, or 4.2 prior to 6.0.4, 5.2.13, or 4.2.30, respectively, you are potentially affected by this vulnerability.
Upgrade Django to version 6.0.4, 5.2.13, or 4.2.30. As a temporary workaround, implement strict Content-Length header validation in your ASGI middleware.
There is currently no public evidence of active exploitation, but the vulnerability's ease of exploitation warrants immediate action.
Refer to the official Django security advisory for detailed information and updates: [https://www.djangoproject.com/security/](https://www.djangoproject.com/security/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.