CVE-2026-33034

score

<0.1

cvss

7.5

epss

0.9%

published

2026-04-07

kev added

—

first seen

2026-10-21

Django < 6.0.4, < 5.2.13, and < 4.2.30 contain a denial of service caused by ASGI requests with missing or understated Content-Length header bypassing DATA_UPLOAD_MAX_MEMORY_SIZE, letting remote attackers load unbounded request body into memory, exploit requires crafted ASGI request.