PT-2026-37077

CVE-2026-5766

Published

2026-05-05

Updated

2026-07-19

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.4 Django versions 5.2 through 5.2.13

Description ASGI requests with a missing or understated Content-Length header can bypass the FILE UPLOAD MAX MEMORY SIZE limit. This allows large files to be loaded into memory, which can lead to service degradation and a potential denial-of-service. ASGI (Asynchronous Server Gateway Interface) is a standard for asynchronous Python web servers to communicate with web applications.

Recommendations Update versions 6.0 through 6.0.4 to version 6.0.5. Update versions 5.2 through 5.2.13 to version 5.2.14. Configure a limit at the web server level to avoid relying solely on FILE UPLOAD MAX MEMORY SIZE.

Exploitability

Exploit

Fix

Impacts

Researchers

Jacob Walls

Kyle Agronick

Sarah Boyce

Vendors

Affected products

Weakness enumeration

CWE-130: Improper Handling of Length Parameter Inconsistency