Live › vulnerability › CVE-2026-108147
Django's multipart upload parser buffers base64-encoded file uploads entirely in memory before handing them to upload handlers. An attacker who can send uploads can make the server use excessive memory, which can crash or slow the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Applications built on Django that accept multipart file uploads, including base64-encoded parts, are exposed. Sites with no file upload endpoints, or that run a patched Django version, are not affected. Earlier unsupported Django series were not evaluated and may also be affected.
No product ranges from the sources yet.
python -m django --versionMultiPartParser or file upload handling in the project's views or forms6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19; earlier series were not evaluated and may also be affected6.1.36.0.10 for the 6.0 series5.2.19 for the 5.2 seriesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.
django.http.multipartparser.MultiPartParser is subject to excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding, which could be buffered entirely in memory before being passed to upload handlers.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Ignacy Kujawa for reporting this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-108147")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.