# CVE-2026-108147: Django multipart parser excessive memory consumption via base64 Content-Transfer-Encoding

Source: https://junglewise.ai/threats/cve-2026-108147-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-4-before  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-108147 · Severity: medium · CVSS 5.3 · Published 2026-11-03

Django is a popular Python web framework used to build web applications. The multipart file upload parser in Django can consume excessive amounts of memory when processing uploads with base64 Content-Transfer-Encoding, potentially buffering entire files in memory. An attacker sending specially crafted file uploads could exhaust server memory, causing the application to become unresponsive or crash.

Technologies: [Django Software Foundation Django](https://junglewise.ai/threats/technologies/django-software-foundation-django). Vendors: [Django Software Foundation](https://junglewise.ai/threats/vendors/django-software-foundation).

## Quick answers

**Is CVE-2026-108147 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108147 being exploited in the wild.

**How severe is CVE-2026-108147?** Medium severity, with a CVSS score of 5.3, published 3 November 2026.

**Which products and versions are affected?** Django Software Foundation Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, 5.2.13 before 5.2.19; possibly 5.1.x, 5.0.x, 4.2.x.

**Is there a fix for CVE-2026-108147?** Yes: fixed in Django 6.1.3, 6.0.10, 5.2.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108147 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108147?** Check whether you run Django Software Foundation Django at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Django 6.1.3, 6.0.10, 5.2.19

## Technical details

The django.http.multipartparser.MultiPartParser improperly buffers entire base64-encoded file uploads in memory before passing them to upload handlers, rather than streaming data. This is a denial-of-service vulnerability triggered via network-based file upload requests; no authentication or user interaction is required. An attacker can exhaust available memory and crash affected applications.

## Affected products

- Django Software Foundation Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, 5.2.13 before 5.2.19; possibly 5.1.x, 5.0.x, 4.2.x

## Timeline

- 2026-11-03: disclosed

## References

- [https://pypi.org/project/Django/](https://pypi.org/project/Django/)
- [https://docs.djangoproject.com/en/dev/releases/security/](https://docs.djangoproject.com/en/dev/releases/security/)

## Related threats

- [Django GIS spatial reference string injection](https://junglewise.ai/threats/cve-2026-114582-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django SSRF in GeoJSON coordinate reference systems](https://junglewise.ai/threats/cve-2026-111362-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django log injection in BaseGeometryWidget.deserialize()](https://junglewise.ai/threats/cve-2026-111211-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django authorization bypass in BaseModelFormSet deletion](https://junglewise.ai/threats/cve-2026-87975-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0)
- [Django spatial lookups SSRF via crafted VRT document](https://junglewise.ai/threats/cve-2026-87890-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0)