CVE-2026-108147
Medium · 5.3CVSS
5.3
EPSS
0.6%
Published
Nov 3, 2026
CISA due date
—
The record
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Ignacy Kujawa for reporting this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116646 Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response. CWE-770
- CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using… CWE-770
- CVE-2026-63501 ag-psd is a JavaScript library for reading and writing Photoshop Document files. CWE-770
- CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead… CWE-770
- CVE-2026-115716 Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to… CWE-770
- CVE-2026-118487 In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in… CWE-770
- CVE-2026-121412 FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption… CWE-770
- CVE-2026-121405 FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP… CWE-770