CVE-2026-33033Medium· 6.5▾ TwilightPoC availableDjango has potential DoS via MultiPartParser through crafted multipart uploads
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.9%
1 GitHub repo (last check)
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with Content-Transfer-Encoding: base64 including excessive whitespace.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
django >= 6.0, < 6.0.4django >= 5.2, < 5.2.13django >= 4.2, < 4.2.30Upgrade to a patched release:
django 6.0.4django 5.2.13django 4.2.30Connected by shared product, vendor, weakness, or advisory.
CVE-2025-64458High· 7.5Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
CVE-2025-32873Medium· 5.3Django has a denial-of-service possibility in strip_tags()
CVE-2025-57833High· 7.1Django is subject to SQL injection through its column aliases
CVE-2026-1312Medium· 5.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, w…
CVE-2026-1207Medium· 5.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupport…
CVE-2026-5766Medium· 5.3Django has an Improper Handling of Length Parameter Inconsistency