MEDIUM 6.9 NVD
CVE-2026-108147
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. `django.http.multipartparser.MultiPartParser` is subject to e
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.
`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Ignacy Kujawa for reporting this issue.
References
- https://docs.djangoproject.com/en/dev/releases/security/
- https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8
- https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f
- https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e
- https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.