Executive brief
A vulnerability in the Django web framework could allow an attacker to slow down or crash a website by uploading specially crafted files. By including excessive whitespace in certain parts of a file upload request, an attacker can force the server to spend an enormous amount of processing power on a single request. This can lead to a denial-of-service, making the application unavailable to legitimate users.
Technical details
A denial-of-service vulnerability exists in Django's MultiPartParser component due to inefficient algorithmic complexity (CWE-407). When a remote attacker submits a multipart/form-data upload that specifies 'Content-Transfer-Encoding: base64', the parser may experience significant performance degradation if the payload contains excessive whitespace. This occurs because the processing time for such crafted inputs scales poorly, allowing a single request to consume disproportionate CPU resources. The issue is resolved in Django versions 6.0.4, 5.2.13, and 4.2.30. Older unsupported versions like 5.0.x and 3.2.x may also be affected but were not officially evaluated.
Affected products
- Django Software Foundation Django >= 6.0, < 6.0.4; >= 5.2, < 5.2.13; >= 4.2, < 4.2.30
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched