CVE-2026-5766

Summary

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated Content-Length header can bypass the FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into memory and causing service degradation.

As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kyle Agronick for reporting this issue.

Affected Software

VendorProductVersion RangeStatus
djangoprojectDjango6.0 < 6.0.5affected
djangoprojectDjango6.0.5unaffected
djangoprojectDjango5.2 < 5.2.14affected
djangoprojectDjango5.2.14unaffected

Weaknesses

  • CWE-130: CWE-130: Improper Handling of Length Parameter Inconsistency

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References