平台
python
组件
django
修复版本
6.0.4
5.2.13
4.2.30
6.0.4
4.2.30
4.2.30
CVE-2026-33034 是 Django 框架中的一个安全漏洞，该漏洞源于 ASGI 请求中 Content-Length 头部缺失或不准确的情况。攻击者可以利用此漏洞绕过 DATAUPLOADMAXMEMORYSIZE 限制，将无限大的请求体加载到内存中，可能导致拒绝服务或信息泄露。该漏洞影响 Django 6.0 之前的 6.0.4 版本，5.2 之前的 5.2.13 版本，以及 4.2 之前的 4.2.30 版本。目前已发布 6.0.4 版本修复此问题。
This vulnerability allows a remote attacker to bypass Django's memory limits for uploaded data. By sending a request with a manipulated Content-Length header, an attacker can force Django to load an arbitrarily large request body into memory. This can lead to a denial-of-service (DoS) condition, potentially crashing the Django application or exhausting server resources. The impact is particularly severe in environments where Django handles user-uploaded files or processes large data payloads. While the description doesn't explicitly mention data exfiltration, the memory exhaustion could be a precursor to other attacks, such as attempting to overload the system and gain access to sensitive information.
This vulnerability was publicly disclosed on 2026-04-07. There is currently no indication of active exploitation in the wild, but the ease of exploitation and the potential for DoS attacks warrant immediate attention. The vulnerability is not listed on CISA KEV as of this writing. Superior reported the issue, indicating a proactive security research effort.
Web applications using Django versions 6.0, 5.2, or 4.2 are at risk, particularly those that handle user-uploaded files or process large data payloads. Shared hosting environments running vulnerable Django applications are also at increased risk due to the potential for cross-tenant attacks.
• python / server:
# Check for vulnerable Django versions
python -c 'import django; print(django.get_version())'• python / server:
# Examine ASGI middleware for Content-Length validation
# (Review your custom middleware code)• generic web:
# Check Django application logs for errors related to Content-Length or memory limits
# (Look for exceptions related to exceeding DATA_UPLOAD_MAX_MEMORY_SIZE)disclosure
漏洞利用状态
EPSS
0.03% (9% 百分位)
CVSS 向量
The primary mitigation is to upgrade Django to a patched version: 6.0.4, 5.2.13, or 4.2.30. If upgrading immediately is not feasible, consider implementing a temporary workaround by strictly validating the Content-Length header in your ASGI middleware. This could involve rejecting requests with missing or suspiciously small headers. Additionally, review your DATAUPLOADMAXMEMORYSIZE setting to ensure it is appropriately configured to limit the amount of memory consumed by uploaded data. After upgrade, confirm the fix by sending a test request with a deliberately oversized Content-Length header and verifying that Django correctly rejects it.
Actualice Django a la versión 6.0.4, 5.2.13 o 4.2.30 o superior para mitigar la vulnerabilidad. Esta actualización corrige un problema que permite a los atacantes cargar cuerpos de solicitud ilimitados en la memoria, lo que podría provocar una denegación de servicio. Consulte las notas de la versión para obtener más detalles.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2026-33034 是 Django 框架中的一个漏洞，允许攻击者绕过 DATAUPLOADMAXMEMORYSIZE 限制，导致内存溢出。该漏洞源于 ASGI 请求中 Content-Length 头部缺失或不准确。
如果您正在使用 Django 6.0 ≤6.0.3, 5.2 ≤5.2.13, 或 4.2 ≤4.2.30 版本，则可能受到此漏洞的影响。 早期不支持的 Django 版本 (例如 5.0.x, 4.1.x, 和 3.2.x) 也可能受到影响，但未进行评估。
升级到 Django 6.0.4 版本可以修复此漏洞。请尽快更新您的 Django 版本以避免潜在的安全风险。
上传你的 requirements.txt 文件，立即知道是否受影响。