Django 6.1.3 Memory Exhaustion in MultiPartParser via Base64
CVE-2026-108147 Published on November 3, 2026
Potential memory exhaustion in MultiPartParser via base64-encoded file upload
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.
`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Ignacy Kujawa for reporting this issue.
Timeline
Initial report received.
Vulnerability confirmed. 38 days later.
Security release issued. 19 days later.
Weakness Type
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Products Associated with CVE-2026-108147
Want to know whenever a new CVE is published for Django Project Django? stack.watch will email you.
Affected Versions
djangoproject Django:- Version 6.1 and below 6.1.3 is affected.
- Version 6.1.3 is unaffected.
- Version 6.0 and below 6.0.4 is unaffected.
- Version 6.0.4 and below 6.0.10 is affected.
- Version 6.0.10 is unaffected.
- Version 5.2 and below 5.2.13 is unaffected.
- Version 5.2.13 and below 5.2.19 is affected.
- Version 5.2.19 is unaffected.