---
id: "CVE-2026-108147"
kind: "vulnerability"
aliases: ["CVE-2026-108147"]
title: "Django: multipart uploads with base64 encoding can exhaust server memory"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["django", "package", "python", "self-hosted"]
not_affected_if: ["no-file-uploads", "patched-version"]
published_at: "2026-11-03T16:17:18+00:00"
first_seen_at: "2026-11-03T16:21:42+00:00"
updated_at: "2026-11-03T16:24:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108147", "first_seen_at": "2026-11-03T16:21:42+00:00"}]
---

# Django: multipart uploads with base64 encoding can exhaust server memory

Django's multipart upload parser buffers base64-encoded file uploads entirely in memory before handing them to upload handlers. An attacker who can send uploads can make the server use excessive memory, which can crash or slow the application.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Django version with `python -m django --version`
- Look for `MultiPartParser` or file upload handling in the project's views or forms
- Affected series are 6.1 before `6.1.3`, 6.0 before `6.0.10`, and 5.2 before `5.2.19`; earlier series were not evaluated and may also be affected

## Fix

- Django `6.1.3` for the 6.1 series
- Django `6.0.10` for the 6.0 series
- Django `5.2.19` for the 5.2 series
- Earlier unsupported series: unknown

## Timeline

- 2026-11-03T16:21:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108147

## Documents

- [fix] Patch: github.com https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8
- [fix] Patch: github.com https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f
- [fix] Patch: github.com https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e
- [fix] Patch: github.com https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02

## From the sources

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.
`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Ignacy Kujawa for reporting this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_