Django CVE-2026-33034

Remote unauthenticated attacker sending ASGI requests with missing or understated Content-Length header to Django 6.0 before 6.0.4, 5.2 before 5.2.13, or 4.2 before 4.2.30. No victim interaction required. Exploits DATA_UPLOAD_MAX_MEMORY_SIZE bypass.

Real-world risk is significant for internet-facing Django ASGI applications. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-accessible attack requiring no authentication, low technical complexity, and no user interaction-trivially exploitable conditions. The High availability impact (A:H) reflects the denial-of-service outcome when server memory exhausts. However, the absence of confidentiality or integrity impact (C:N/I:N) limits this to availability disruption rather than data breach. No public exploit code exists at time of analysis, and no CISA KEV listing indicates active exploitation is not confirmed in production environments. The attack is automatable-simple HTTP clients can craft malicious requests-making it viable for both targeted attacks and opportunistic scanning. SSVC technical impact assessment would classify this as partial (service degradation/DoS) rather than total system compromise. Priority depends heavily on deployment context: critical for public-facing ASGI services handling untrusted input, moderate for internal APIs with rate limiting or resource controls, lower for WSGI-only deployments. The Django Security Foundation's rapid coordinated release across three branches signals vendor assessment of meaningful production risk.

An attacker identifies a Django ASGI application (e.g., real-time chat service using Django Channels with Daphne) and crafts HTTP POST requests with Content-Length header set to 1 byte while streaming gigabytes of payload data. The Django ASGI handler fails to enforce DATA_UPLOAD_MAX_MEMORY_SIZE during HttpRequest.body parsing, consuming server RAM without limit. By sending multiple concurrent requests from distributed sources, the attacker exhausts available memory, triggering OOM killer processes or cascading service failures. The application becomes unresponsive to legitimate users, achieving denial of service. The attack requires only basic HTTP client capabilities (curl, Python requests library) with no authentication, making it accessible to unsophisticated attackers scanning for Django fingerprints.