CVE-2026-5766— Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass

Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kyle Agronick for reporting this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

长度参数不一致性处理不恰当

Django 安全漏洞

Django是Django基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 6.0.5之前版本和5.2.14之前版本存在安全漏洞，该漏洞源于ASGI请求缺少或低估Content-Length标头，可能绕过FILE_UPLOAD_MAX_MEMORY_SIZE限制，导致大文件加载到内存中并造成服务降级。

N/A

N/A