Input validation error in Django - CVE-2026-5766

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU130190

Input validation error in Django - CVE-2026-5766

Published: May 5, 2026


Vulnerability identifier: #VU130190
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-5766
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ASGI request handling when processing file uploads with a missing or understated Content-Length header. A remote attacker can send a specially crafted request to cause a denial of service.

Large uploaded files may be loaded into memory, causing service degradation.


Affected software

Django
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
Fedora
python3-Django
python-django-help
python-django
python-django (Ubuntu package)
python311-Django
python-django5
python-django6

How to mitigate CVE-2026-5766

Install security update from vendor's website.

Django - addressed in versions 5.2.14, 6.0.5
python3-Django - addressed in versions 2.2.27-23, 4.2.15-15
python-django-help - addressed in versions 2.2.27-23, 4.2.15-15
python-django - addressed in versions 2.2.27-23, 4.2.15-15
python-django (Ubuntu package) - addressed in versions 2:3.2.12-2ubuntu1.27, 3:4.2.11-1ubuntu1.16, 3:5.2.4-1ubuntu2.5, 3:5.2.9-0ubuntu4.1
python311-Django - update to 4.2.11-150600.3.56.1
python-django5 - addressed in versions 5.2.14-1.fc42, 5.2.14-1.fc43, 5.2.14-1.fc44
python-django6 - update to 6.0.5-1.fc44

External References

Related Security Bulletins