CVE-2026-33033 PUBLISHED

Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

Assigner: DSF
Reserved: 17.03.2026 Published: 07.04.2026 Updated: 07.04.2026

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with Content-Transfer-Encoding: base64 including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

Product Status

Vendor djangoproject
Product Django
Versions Default: unaffected
  • affected from 6.0 to 6.0.4 (excl.)
  • Version 6.0.4 is unaffected
  • affected from 5.2 to 5.2.13 (excl.)
  • Version 5.2.13 is unaffected
  • affected from 4.2 to 4.2.30 (excl.)
  • Version 4.2.30 is unaffected

Credits

  • Seokchan Yoon reporter
  • Natalia Bidart remediation developer
  • Jacob Walls coordinator

References

Problem Types

  • CWE-407: Inefficient Algorithmic Complexity CWE

Impacts

  • CAPEC-130: Excessive Allocation