Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-33033 BIT-django-2026-33033EUVD-2026-19646GHSA-5mf9-h53q-7mhqPYSEC-2026-48

Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

Published Apr 7, 2026 · Updated Apr 7, 2026 · Assigned by DSF

Vendor: djangoproject Product: Django Package: django Package: py3-django Package: python-django Package: python-django Ecosystem: Alpine Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Affected products

VendorProductAffectedFixed
djangoproject Django 6.0 – < 6.0.4, 5.2 – < 5.2.13, 4.2 – < 4.2.30 6.0.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python-django 3:4.2.30-1 —
Debian 13 python-django No fix yet —
Debian 12 python-django No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 python-django 3:5.2.9-0ubuntu4 —
Ubuntu 26.04 LTS python-django 3:5.2.9-0ubuntu4 —
Ubuntu 25.10 python-django 3:5.2.4-1ubuntu2.4 USN-8154-1
Ubuntu 24.04 LTS python-django 3:4.2.11-1ubuntu1.15 USN-8154-1
Ubuntu 22.04 LTS python-django 2:3.2.12-2ubuntu1.26 USN-8154-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS python-django 2:2.2.12-1ubuntu0.29+esm8 USN-8154-1
Ubuntu Pro 18.04 LTS python-django 1:1.11.11-1ubuntu1.21+esm15 USN-8154-1
Ubuntu Pro 16.04 LTS python-django 1.8.7-1ubuntu5.15+esm12 —
Ubuntu Pro 14.04 LTS python-django 1.6.11-0ubuntu1.3+esm11 —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-Django 5.2.13-1.1 openSUSE-SU-2026:10567-1
openSUSE Tumbleweed python-Django4 4.2.30-1.1 openSUSE-SU-2026:10516-1
openSUSE Tumbleweed python-Django5 5.2.16-1.1 openSUSE-SU-2026:11270-1
openSUSE Tumbleweed python-Django6 6.0.4-1.1 openSUSE-SU-2026:10517-1
openSUSE Leap 16.0 python-Django 5.2.4-bp160.7.1 openSUSE-SU-2026:20578-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 py3-django 5.2.13-r0 —
Alpine v3.23 py3-django 4.2.30-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI django >= 6.0, < 6.0.4 6.0.4 GHSA-5mf9-h53q-7mhq
PyPI django >= 5.2, < 5.2.13 5.2.13 GHSA-5mf9-h53q-7mhq
PyPI django >= 4.2, < 4.2.30 4.2.30 GHSA-5mf9-h53q-7mhq
PyPI django >= 4.2, < 4.2.30 · >= 5.2, < 5.2.13 · >= 6.0, < 6.0.4 4.2.30, 5.2.13, 6.0.4 PYSEC-2026-48

Advisories 7

References