Skip to main content

Allocation of Resources Without Limits or Throttling

CVE-2026-33034

High
7.5/10

Summary

Django contains a Denial of Service (DoS) vulnerability related to "ASGIRequest" handling. Versions 6.0 through 6.0.3, 5.2 through 5.2.12, and 4.2 through 4.2.29 allow ASGI requests with a missing or understated "Content-Length" header to bypass the "DATA_UPLOAD_MAX_MEMORY_SIZE" limit when reading "HttpRequest.body". This may allow a remote attacker to load an unbounded request body into memory.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published