Improper input validation in Django - CVE-2026-33034

Vulnerability identifier: #VU125097

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-33034

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ASGI request handling when reading HttpRequest.body from requests with a missing or understated Content-Length header. A remote attacker can send a specially crafted request to cause a denial of service.

The issue can bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit and load an unbounded request body into memory.

Django
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Fedora
Ubuntu
SUSE Package Hub 15
openSUSE Leap
openEuler
Anolis OS
python-django (Ubuntu package)
python311-Django
python-django
python3-Django
python-django-help
python3-django-doc
python3-django-bash-completion
python3-django
python-django4.2
python-django5
python-django6

Install security update from vendor's website.

Django - addressed in versions 4.2.30, 5.2.13, 6.0.4
python-django (Ubuntu package) - addressed in versions 1.6.11-0ubuntu1.3+esm11, 1.8.7-1ubuntu5.15+esm12, 1:1.11.11-1ubuntu1.21+esm15, 2:2.2.12-1ubuntu0.29+esm8, 2:3.2.12-2ubuntu1.26, 3:4.2.11-1ubuntu1.15, 3:5.2.4-1ubuntu2.4
python311-Django - update to 4.2.11-150600.3.56.1
python-django - update to 4.2.15-15
python3-Django - update to 4.2.15-15
python-django-help - update to 4.2.15-15
python3-django-doc - update to 4.2.30-1
python3-django-bash-completion - update to 4.2.30-1
python3-django - update to 4.2.30-1
python-django4.2 - update to 4.2.30-2.el9
python-django5 - addressed in versions 5.2.14-1.fc42, 5.2.14-1.fc43, 5.2.14-1.fc44
python-django6 - update to 6.0.5-1.fc44

• https://www.djangoproject.com/weblog/2026/apr/07/security-releases/

• Multiple vulnerabilities in Django
• Ubuntu update for python-django
• Ubuntu update for python-django
• Anolis OS update for python-django
• SUSE update for python-Django
• openEuler 24.03 LTS SP3 update for python-django
• openEuler 24.03 LTS SP1 update for python-django
• openEuler 24.03 LTS update for python-django
• openEuler 22.03 LTS SP4 update for python-django
• Fedora 44 update for python-django6
• Fedora 43 update for python-django5
• Fedora 44 update for python-django5
• Fedora 42 update for python-django5
• Fedora EPEL 9 update for python-django4.2