CVE-2026-108147
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Ignacy Kujawa for reporting this issue.
- CVSS
- 6.9
- EPSS
- —
- CISA KEV
- Not listed
- Exploitation
- No report
- Public exploits
- None seen
- State
- PUBLISHED
Coverage
Framework blogs: Next.js releases / Svelte / Angular / Django / Rails / Laravel / Spring / React Native / FlutterAuthoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards
Django security releases issued: 6.1.3, 6.0.10, and 5.2.19
In accordance with our security release policy, the Django team is issuing releases for Django 6.1.3, Django 6.0.10, and Django 5.2.19. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-108147: Potential memory…
What we observed
No signals recorded