Django CVE-2026-108147

The target Django application must process multipart/form-data file uploads via django.http.multipartparser.MultiPartParser (the default request handling path whenever an endpoint accepts file uploads). The attacker sends an upload with the header Content-Transfer-Encoding: base64; per the vendor release notes the base64-encoded content is then buffered entirely in memory regardless of the FILE_UPLOAD_MAX_MEMORY_SIZE setting before being passed to upload handlers. Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required. The main limiting factor is reachability: exploitation requires an endpoint that actually accepts file uploads - applications with no upload-accepting views are not exposed - and the impact is bounded memory exhaustion (availability only, rated low by the vendor) rather than code execution or data disclosure.

This is a genuine but modest-priority issue, best characterized as a high-reachability, low-impact denial-of-service. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 and confirms the flaw is remotely reachable with low complexity, no authentication (PR:N) and no user interaction - meaning any unauthenticated client that can reach an endpoint accepting multipart file uploads can trigger it. However, impact is confined to availability at the Low level (VA:L; VC:N/VI:N/VA:L), consistent with memory pressure rather than service crash, and Django's own security policy rates the issue severity 'low.' There is no EPSS score, no CISA KEV listing, and no PoC or exploit reference in the input - only vendor patch commits - so the real-world exploitation signal is weak despite easy theoretical reachability. The vuln.today decision label is 'this_month,' not act_now or emergency, which aligns with the signals: easy to trigger, but bounded resource-exhaustion impact rather than RCE or data exposure. Net assessment: patch on a routine monthly cadence; this is not a high-CVSS-but-unreachable paper tiger, nor is it an emergency - it is a real, easily-reached, low-severity DoS.

An unauthenticated attacker locates a Django endpoint that accepts multipart/form-data file uploads and sends a crafted upload using Content-Transfer-Encoding: base64. Because the base64-encoded body is buffered entirely in memory regardless of the FILE_UPLOAD_MAX_MEMORY_SIZE setting before being handed to upload handlers, a sufficiently large payload (or many concurrent requests) drives up memory consumption on the server. No PoC or exploit code is referenced in the available data; the attack follows directly from the network vector (AV:N) and low complexity (AC:L/AT:N) described by the CVSS metrics.