Django CVE-2026-5766

Exploitation requires: (1) a Django application using ASGI mode (not WSGI), (2) a publicly accessible or network-accessible file upload endpoint, (3) no Content-Length validation enforced by an upstream reverse proxy or web server, and (4) FILE_UPLOAD_MAX_MEMORY_SIZE configured in Django (the default is 2.5 MB). The vulnerability does NOT require authentication (PR:N) or user interaction (UI:N). It is limited to ASGI deployments; WSGI-based Django applications are unaffected because WSGI servers typically enforce upload limits before reaching the Django application layer. The attack is further constrained by available server memory and network bandwidth, so instances with small RAM pools may hit system limits before Django's internal checks.

CVSS 6.3 with AV:N/AC:L indicates network-accessible exploitation with low complexity. However, the CVSS vector includes AT:P (attack time, possibly in attack tool required) and targets availability only (VA:L, scope=N), indicating medium rather than critical severity. The vulnerability is not confirmed actively exploited (no KEV listing in provided data), but the low attack complexity and lack of authentication requirements (PR:N, UI:N) mean any remote actor can probe and exploit affected instances. The real-world risk depends heavily on deployment: Django instances behind load balancers or proxies that enforce Content-Length validation are protected; instances directly exposed to untrusted networks without such protections face denial-of-service risk. The vulnerability is not a code execution or data breach vector but a resource exhaustion attack surface. Given that Django's own documentation recommends web-server-level upload limits, many deployments may already have mitigations in place, reducing practical impact.

An attacker sends an ASGI POST request to a Django file upload endpoint (e.g., a form submission handler) with a Content-Length header set to 100 bytes but a multipart form body containing 100 MB of data. Django's upload handler reads the body into memory without validating that it exceeds FILE_UPLOAD_MAX_MEMORY_SIZE, consuming gigabytes of RAM. If the attacker repeats this across multiple concurrent connections, the application server exhausts available memory and becomes unresponsive, achieving denial of service.