| Package | Affected versions | Patched versions |
|---|---|---|
| django | ≥ 5.2, < 5.2.14≥ 6.0, < 6.0.5 | 5.2.146.0.5 |
| django | ≥ 5.2, < 5.2.14≥ 6.0, < 6.0.5 | 5.2.146.0.5 |
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated Content-Length header can bypass the FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into memory and causing service degradation.
As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django thanks Kyle Agronick for reporting this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free