CVE-2026-33034

{
  "id": "CVE-2026-33034",
  "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
  "published": "2026-04-07T15:17:39.393",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nASGI requests with a missing or understated `Content-Length` header could\r\nbypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading\r\n`HttpRequest.body`, allowing remote attackers to load an unbounded request body into\r\nmemory.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Superior for reporting this issue."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en 6.0 anterior a 6.0.4, 5.2 anterior a 5.2.13 y 4.2 anterior a 4.2.30.\nLas solicitudes ASGI con un encabezado ’Content-Length’ faltante o subestimado podrían eludir el límite de ’DATA_UPLOAD_MAX_MEMORY_SIZE’ al leer ’HttpRequest.body’, permitiendo a atacantes remotos cargar un cuerpo de solicitud ilimitado en la memoria.\nLas series de Django anteriores y no compatibles (como 5.0.x, 4.1.x y 3.2.x) no fueron evaluadas y también podrían estar afectadas.\nDjango desea agradecer a Superior por reportar este problema."
    }
  ],
  "affected": [
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "affectedData": [
        {
          "vendor": "djangoproject",
          "product": "Django",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.org/project/Django/",
          "packageName": "django",
          "repo": "https://github.com/django/django/",
          "versions": [
            {
              "version": "6.0",
              "lessThan": "6.0.4",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0.4",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.2",
              "lessThan": "5.2.13",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.2.13",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "4.2",
              "lessThan": "4.2.30",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.2.30",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-07T20:43:43.119514Z",
          "id": "CVE-2026-33034",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.2",
              "versionEndExcluding": "4.2.30",
              "matchCriteriaId": "C78D8198-229F-45A2-B09D-C1D272878E3E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.2",
              "versionEndExcluding": "5.2.13",
              "matchCriteriaId": "5ED295FD-7063-40A1-9A3E-C0CC4D6F7BD3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0",
              "versionEndExcluding": "6.0.4",
              "matchCriteriaId": "344A677E-BD67-42F0-9746-5B0D4C53815E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.djangoproject.com/en/dev/releases/security/",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://groups.google.com/g/django-announce",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}