Summary
Seokchan Yoon discovered that Django incorrectly handled copying memory
when parsing multipart uploads with excessive whitespace. A remote attacker
could possibly use this issue to cause Django to use excessive resources,
leading to a denial of service. (CVE-2026-33033)
It was discovered that Django did not enforce an upload memory size limit
in the Content-Length header. A remote attacker could possibly use this
issue to cause Django to use excessive resources, leading to a denial of
service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10.
(CVE-2026-33034)
Tarek Nakkouch discovered that Django incorrectly handled underscores in
the ASGI headers. A remote attacker could possibly use this issue to spoof
HTTP headers. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,
and Ubuntu 25.10. (CVE-2026-3902)
It was discovered that Django incorrectly handled verification of model
data created with POST requests. A remote attacker could possibly use this
issue to forge new model permissions. (CVE-2026-4277, CVE-2026-4292)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | python-django | 2:3.2.12-2ubuntu1.26 |
| Ubuntu · 24.04 LTS 24.04:LTS | python-django | 3:4.2.11-1ubuntu1.15 |
| Ubuntu · 25.10 | python-django | 3:5.2.4-1ubuntu2.4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-django | 1:1.11.11-1ubuntu1.21+esm15 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-django | 2:2.2.12-1ubuntu0.29+esm8 |
Vulnerabilities 5
-
Critical 9.8
Privilege abuse in GenericInlineModelAdmin
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5…
-
High 7.5
Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`, allowing remote at…
-
High 7.5
ASGI header spoofing via underscore/hyphen conflation
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version wit…
-
Medium 6.5CVE-2026-33033 Public exploit
Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Ea…
-
Low 2.7
Privilege abuse in ModelAdmin.list_editable
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as …