{"id":"CVE-2026-108147","kind":"vulnerability","aliases":["CVE-2026-108147"],"related":[],"title":"Django: multipart uploads with base64 encoding can exhaust server memory","description":"An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue.","summary":"Django's multipart upload parser buffers base64-encoded file uploads entirely in memory before handing them to upload handlers. An attacker who can send uploads can make the server use excessive memory, which can crash or slow the application.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["django","package","python","self-hosted"],"not_affected_if":["no-file-uploads","patched-version"],"how_to_check":"- Check the installed Django version with `python -m django --version`\n- Look for `MultiPartParser` or file upload handling in the project's views or forms\n- Affected series are 6.1 before `6.1.3`, 6.0 before `6.0.10`, and 5.2 before `5.2.19`; earlier series were not evaluated and may also be affected","fix":"- Django `6.1.3` for the 6.1 series\n- Django `6.0.10` for the 6.0 series\n- Django `5.2.19` for the 5.2 series\n- Earlier unsupported series: unknown","status":"open","published_at":"2026-11-03T16:17:18+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","triaged_at":"2026-11-03T16:24:04+00:00","updated_at":"2026-11-03T16:24:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:24:04Z","model":"claude-haiku-5-5","output":{"fix":"- Django `6.1.3` for the 6.1 series\n- Django `6.0.10` for the 6.0 series\n- Django `5.2.19` for the 5.2 series\n- Earlier unsupported series: unknown","reach":"internet","title":"Django: multipart uploads with base64 encoding can exhaust server memory","impact":"medium","summary":"Django's multipart upload parser buffers base64-encoded file uploads entirely in memory before handing them to upload handlers. An attacker who can send uploads can make the server use excessive memory, which can crash or slow the application.","audience":"businesses","category":"package","nicknames":[],"who_cares":["django","python","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Server memory is exhausted by large uploads, causing crashes or denial of service","analyst_note":"","how_to_check":"- Check the installed Django version with `python -m django --version`\n- Look for `MultiPartParser` or file upload handling in the project's views or forms\n- Affected series are 6.1 before `6.1.3`, 6.0 before `6.0.10`, and 5.2 before `5.2.19`; earlier series were not evaluated and may also be affected","plain_action":"","needs_analyst":false,"not_affected_if":["no-file-uploads","patched-version"],"who_is_affected":"Applications built on Django that accept multipart file uploads, including base64-encoded parts, are exposed. Sites with no file upload endpoints, or that run a patched Django version, are not affected. Earlier unsupported Django series were not evaluated and may also be affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4305,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108147':13A,16A '-2026':12A,15A '4.2':121C '5.0':118C '5.1':116C '5.2.13':76C '5.2.19':78C '6.0.10':74C '6.0.4':72C '6.1':69C '6.1.3':71C 'affect':130C 'also':128C 'applic':62B 'attack':44B 'base64':5A,30B,92C 'base64-encoded':29B 'buffer':28B,100C 'consumpt':85C 'content':94C 'content-transfer-encod':93C 'could':98C 'crash':58B 'cve':11A,14A 'discov':66C 'django':1A,17B,23B,68C,112C,131C 'django.http.multipartparser.multipartparser':79C 'earlier':110C 'encod':6A,31B,96C 'entir':34B,101C 'evalu':125C 'excess':54B,83C 'exhaust':8A 'file':32B,89C 'hand':38B 'handler':42B,109C 'host':22B 'ignaci':136C 'issu':64C,141C 'kujawa':137C 'like':133C 'make':50B 'may':127C 'memori':10A,36B,55B,84C,103C 'multipart':2A,25B,88C 'packag':18B 'parser':27B 'pass':106C 'process':87C 'python':19B 'report':139C 'self':21B 'self-host':20B 'send':47B 'seri':113C 'server':9A,52B 'slow':60B 'subject':81C 'thank':135C 'transfer':95C 'unsupport':111C 'upload':3A,26B,33B,41B,48B,90C,108C 'use':53B 'would':132C 'x':117C,119C,122C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Django that accept multipart file uploads, including base64-encoded parts, are exposed. Sites with no file upload endpoints, or that run a patched Django version, are not affected. Earlier unsupported Django series were not evaluated and may also be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["django","medium","package","python","selfhosted"],"first_public_at":"2026-11-03T16:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108147","severity":null,"published_at":"2026-11-03T16:17:18+00:00","modified_at":"2026-11-03T16:17:18+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","fetched_at":"2026-11-03T16:21:42+00:00","note":null}],"documents":[{"id":58777,"url":"https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58778,"url":"https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58779,"url":"https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58780,"url":"https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}