Resource exhaustion in Django - CVE-2026-33033

Vulnerability identifier: #VU125096

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-33033

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in django.http.multipartparser.MultiPartParser when processing multipart uploads with base64-encoded files containing excessive whitespace. A remote attacker can send a specially crafted multipart upload to cause a denial of service.

The issue may trigger repeated memory copying and degrade performance.

Django
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Fedora
Ubuntu
SUSE Package Hub 15
openSUSE Leap
openEuler
Anolis OS
python-django (Ubuntu package)
python-django
python3-Django
python-django-help
python311-Django
python3-django-doc
python3-django-bash-completion
python3-django
python-django4.2
python-django5
python-django6

Install security update from vendor's website.

Django - addressed in versions 4.2.30, 5.2.13, 6.0.4
python-django (Ubuntu package) - addressed in versions 1.6.11-0ubuntu1.3+esm11, 1.8.7-1ubuntu5.15+esm12, 1:1.11.11-1ubuntu1.21+esm15, 2:2.2.12-1ubuntu0.29+esm8, 2:3.2.12-2ubuntu1.26, 3:4.2.11-1ubuntu1.15, 3:5.2.4-1ubuntu2.4
python-django - addressed in versions 2.2.27-22, 4.2.15-15
python3-Django - addressed in versions 2.2.27-22, 4.2.15-15
python-django-help - addressed in versions 2.2.27-22, 4.2.15-15
python311-Django - update to 4.2.11-150600.3.56.1
python3-django-doc - update to 4.2.30-1
python3-django-bash-completion - update to 4.2.30-1
python3-django - update to 4.2.30-1
python-django4.2 - update to 4.2.30-2.el9
python-django5 - addressed in versions 5.2.14-1.fc42, 5.2.14-1.fc43, 5.2.14-1.fc44
python-django6 - update to 6.0.5-1.fc44

• https://www.djangoproject.com/weblog/2026/apr/07/security-releases/

• Multiple vulnerabilities in Django
• Ubuntu update for python-django
• Ubuntu update for python-django
• Anolis OS update for python-django
• SUSE update for python-Django
• openEuler 24.03 LTS SP3 update for python-django
• openEuler 24.03 LTS SP1 update for python-django
• openEuler 24.03 LTS update for python-django
• openEuler 22.03 LTS SP4 update for python-django
• openEuler 20.03 LTS SP4 update for python-django
• Fedora 44 update for python-django6
• Fedora 43 update for python-django5
• Fedora 44 update for python-django5
• Fedora 42 update for python-django5
• Fedora EPEL 9 update for python-django4.2