Django releases security updates for six CVEs
Django security releases address multiple vulnerabilities including CVE-2026-108147, CVE-2026-111211, CVE-2026-111362, CVE-2026-113593, CVE-2026-113733, and CVE-2026-114582.
40
CVE-2026-108147
Memory exhaustion in Django MultiPartParser for base64 uploads before 6.1.3, 6.0.10, 5.2.19
- CVSS 4.0
- 6.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Django MultiPartParser consumes excessive memory when parsing multipart file uploads using base64 Content-Transfer-Encoding, potentially buffering the entire upload. Attackers can trigger this via unauthenticated network requests to web apps using vulnerable Django versions. This leads to denial of service through memory exhaustion. Affected are users of Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.
What to do: Upgrade to Django 6.1.3, 6.0.10, or 5.2.19. No workaround listed.
| Product | Affected | Fixed in |
|---|---|---|
| Django | 6.1 before 6.1.3, 6.0.4 before 6.0.10, 5.2.13 before 5.2.19 | 6.1.3, 6.0.10, 5.2.19 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Ignacy Kujawa for reporting this issue.
- Weakness
- CWE-770
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X