Django: Les requêtes SGI avec un en-tête `Content-Length` manquant ou sous-estimé pouvaient contourner la limite `DATA_UPLOAD_MAX_MEMORY_SIZE`

This vulnerability allows a remote attacker to bypass Django's memory limits for uploaded data. By sending a request with a manipulated Content-Length header, an attacker can force Django to load an arbitrarily large request body into memory. This can lead to a denial-of-service (DoS) condition, potentially crashing the Django application or exhausting server resources. The impact is particularly severe in environments where Django handles user-uploaded files or processes large data payloads. While the description doesn't explicitly mention data exfiltration, the memory exhaustion could be a precursor to other attacks, such as attempting to overload the system and gain access to sensitive information.

Web applications using Django versions 6.0, 5.2, or 4.2 are at risk, particularly those that handle user-uploaded files or process large data payloads. Shared hosting environments running vulnerable Django applications are also at increased risk due to the potential for cross-tenant attacks.

• python / server:

# Check for vulnerable Django versions
python -c 'import django; print(django.get_version())'

• python / server:

# Examine ASGI middleware for Content-Length validation
# (Review your custom middleware code)

• generic web:

# Check Django application logs for errors related to Content-Length or memory limits
# (Look for exceptions related to exceeding DATA_UPLOAD_MAX_MEMORY_SIZE)

1. 2026-04-07Disclosure

   disclosure

1. Réservé2026-03-17
2. Publiée2026-04-07
3. Modifiée2026-04-09
4. EPSS mis à jour2026-04-15

The primary mitigation is to upgrade Django to a patched version: 6.0.4, 5.2.13, or 4.2.30. If upgrading immediately is not feasible, consider implementing a temporary workaround by strictly validating the Content-Length header in your ASGI middleware. This could involve rejecting requests with missing or suspiciously small headers. Additionally, review your DATAUPLOADMAXMEMORYSIZE setting to ensure it is appropriately configured to limit the amount of memory consumed by uploaded data. After upgrade, confirm the fix by sending a test request with a deliberately oversized Content-Length header and verifying that Django correctly rejects it.