{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://pypi.org/project/Django/","packageName":"django","product":"Django","source":"CNA: DSF","vendor":"djangoproject","versions":[{"lessThan":"6.1.3","status":"affected","version":"6.1","versionType":"python"},{"status":"unaffected","version":"6.1.3","versionType":"python"},{"lessThan":"6.0.4","status":"unaffected","version":"6.0","versionType":"python"},{"lessThan":"6.0.10","status":"affected","version":"6.0.4","versionType":"python"},{"status":"unaffected","version":"6.0.10","versionType":"python"},{"lessThan":"5.2.13","status":"unaffected","version":"5.2","versionType":"python"},{"lessThan":"5.2.19","status":"affected","version":"5.2.13","versionType":"python"},{"status":"unaffected","version":"5.2.19","versionType":"python"}]}],"cveId":"CVE-2026-108147","cwes":["CWE-770"],"description":"An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: DSF","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},{"score":6.9,"severity":"medium","source":"CNA: DSF","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"},{"score":6.9,"severity":"medium","source":"NVD: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":5.3,"severity":"medium","source":"NVD: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1793733467467,"publishedAt":1793720498167,"references":[{"source":"CNA: DSF","tags":["vendor-advisory"],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"source":"CNA: DSF","tags":["mailing-list"],"url":"https://groups.google.com/g/django-announce"},{"source":"CNA: DSF","tags":["patch"],"url":"https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f"},{"source":"CNA: DSF","tags":["patch"],"url":"https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e"},{"source":"CNA: DSF","tags":["patch"],"url":"https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02"},{"source":"CNA: DSF","tags":["patch"],"url":"https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8"},{"source":"CNA: DSF","tags":["vendor-advisory"],"url":"https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"url":"https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"url":"https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"url":"https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"url":"https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"url":"https://groups.google.com/g/django-announce"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"url":"https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"}],"remediation":[{"kind":"fix","source":"CNA: DSF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f"},{"kind":"fix","source":"CNA: DSF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e"},{"kind":"fix","source":"CNA: DSF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02"},{"kind":"fix","source":"CNA: DSF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8"}],"revision":"60fb50c42da7dcfeb8244931c5668509b51c4d050af6993a45a7d5cd2836dffa","sources":[{"modifiedAt":1793730397685,"name":"CNA: DSF","retrievedAt":1793732918755,"url":"https://www.cve.org/CVERecord?id=CVE-2026-108147"},{"modifiedAt":1793733467467,"name":"NVD","retrievedAt":1793751676224,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108147"}],"ssvc":{"assessedAt":1793728292901,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Potential memory exhaustion in MultiPartParser via base64-encoded file upload","updatedAt":1793751676224}